[PATCH] thunderbolt: Fix domain reference leak on DPRX work cancel

[PATCH] thunderbolt: Fix domain reference leak on DPRX work cancel

[David Medina via B4 Relay]

From: David Medina <b2amedina@gmail.com>

tb_dp_dprx_start() takes an additional reference to the domain with
tb_domain_get() and passes it as callback_data to tb_tunnel_alloc_dp().
That reference is only released by the callback, tb_dp_tunnel_active(),
which tb_dp_dprx_work() invokes once the DPRX capabilities read completes
or times out.

If the tunnel is deactivated before the DPRX work runs to completion,
tb_dp_dprx_stop() cancels the still pending work. The callback is then
never called and the domain reference held in callback_data leaks. The
domain's reference count never reaches zero, so tb_domain_release() never
runs and a subsequent shutdown/reboot hangs waiting for the domain to be
released.

Release the callback_data domain reference in tb_dp_dprx_stop() when the
DPRX work is canceled, mirroring the release done by the callback.

Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
Cc: stable@vger.kernel.org
Signed-off-by: David Medina <b2amedina@gmail.com>
---
 drivers/thunderbolt/tunnel.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/thunderbolt/tunnel.c b/drivers/thunderbolt/tunnel.c
index 7e8284575dff..971e9a5f8c5c 100644
--- a/drivers/thunderbolt/tunnel.c
+++ b/drivers/thunderbolt/tunnel.c
@@ -1139,8 +1139,18 @@ static void tb_dp_dprx_stop(struct tb_tunnel *tunnel)
 	if (tunnel->dprx_started) {
 		tunnel->dprx_started = false;
 		tunnel->dprx_canceled = true;
-		if (cancel_delayed_work(&tunnel->dprx_work))
+		if (cancel_delayed_work(&tunnel->dprx_work)) {
+			/*
+			 * The DPRX work was canceled before it ran to
+			 * completion, so the callback (tb_dp_tunnel_active)
+			 * never got a chance to release the domain reference
+			 * passed in callback_data. Release it here to keep the
+			 * reference balanced.
+			 */
+			if (tunnel->callback_data)
+				tb_domain_put(tunnel->callback_data);
 			tb_tunnel_put(tunnel);
+		}
 	}
 }
 

---
base-commit: 551c722f40809618230001baccf219193e22fc5a
change-id: 20260930-tb-dprx-fix-9c05d3b88476

Best regards,
--  
David Medina <b2amedina@gmail.com>

Re: [PATCH] thunderbolt: Fix domain reference leak on DPRX work cancel

[Mika Westerberg]

Hi,

On Wed, Sep 30, 2026 at 10:16:35PM -0400, David Medina via B4 Relay wrote:
> From: David Medina <b2amedina@gmail.com>
> 
> tb_dp_dprx_start() takes an additional reference to the domain with
> tb_domain_get() and passes it as callback_data to tb_tunnel_alloc_dp().
> That reference is only released by the callback, tb_dp_tunnel_active(),
> which tb_dp_dprx_work() invokes once the DPRX capabilities read completes
> or times out.
> 
> If the tunnel is deactivated before the DPRX work runs to completion,
> tb_dp_dprx_stop() cancels the still pending work. The callback is then
> never called and the domain reference held in callback_data leaks. The
> domain's reference count never reaches zero, so tb_domain_release() never
> runs and a subsequent shutdown/reboot hangs waiting for the domain to be
> released.
> 
> Release the callback_data domain reference in tb_dp_dprx_stop() when the
> DPRX work is canceled, mirroring the release done by the callback.
> 
> Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Medina <b2amedina@gmail.com>

This should be fixed already by the patches in my fixes branch, can you
try?

https://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt.git/log/?h=fixes