ACK: [SRU][R][PATCH 0/1] Dock ethernet stops working after Thunderbolt dock unplug on Dell systems

[Rickey Castillo]

On 8/3/26 00:36, AceLan Kao via kernel-team wrote:
> From: "Chia-Lin Kao (AceLan)" <acelan.kao at canonical.com>
>
> BugLink: https://bugs.launchpad.net/bugs/2162704
>
> [Impact]
> On Dell systems (CID: 202512-38252) the ethernet port on a Thunderbolt dock
> stops working after the dock is unplugged and plugged back in, or after a
> reboot with the dock attached. It does not happen every time.
>
> The USB port code never detaches the Type-C connector when the component is
> unbound, so the Type-C port keeps a pointer to a USB device that is already
> freed. UCSI then walks that stale pointer when the PD partner disconnects.
> This leaves the Thunderbolt tunnel in a bad state, and the dock's igc NIC
> fails to come up:
>
> [ 12.992293] igc 0000:2e:00.0 eth0: PCIe link lost, device now detached
> [ 12.992986] igc: Failed to read reg 0x0!
> [ 12.993077] WARNING: CPU: 9 PID: 129 at drivers/net/ethernet/intel/igc/igc_main.c:7005 igc_rd32+0xa4/0xc0 [igc]
> [ 12.993344] igc_disable_pcie_master+0x16/0xa0 [igc]
> [ 12.993361] igc_reset_hw_base+0x14/0x170 [igc]
> [ 12.993376] igc_reset+0x63/0x110 [igc]
> [ 12.993387] igc_io_slot_reset+0x9e/0xd0 [igc]
> [ 12.993397] report_slot_reset+0x5d/0xc0
> [ 12.993430] pcie_do_recovery+0x209/0x400
> [ 12.993439] aer_isr_one_error_type+0x235/0x430
> [ 12.993453] aer_isr+0x4e/0x80
> [ 12.993461] irq_thread+0xf4/0x1f0
>
> The stale pointer also shows up as a second sysfs link removal:
>
> kernfs: can not remove 'typec', no directory
> WARNING: CPU: 6 PID: 55 at fs/kernfs/dir.c:1706 kernfs_remove_by_name_ns+0xe9/0xf0
> Workqueue: events ucsi_handle_connector_change [typec_ucsi]
> Call Trace:
>   sysfs_remove_link+0x19/0x50
>   typec_unregister_partner+0x6e/0x120 [typec]
>   ucsi_unregister_partner+0x107/0x150 [typec_ucsi]
>   ucsi_handle_connector_change+0x3ec/0x490 [typec_ucsi]
>
> With worse timing the same stale pointer is used after the memory is freed,
> which is a use-after-free instead of a warning.
>
> [Fix]
> Call typec_deattach() in connector_unbind() before clearing
> port_dev->connector, so unbind mirrors what connector_bind() does. This
> clears port->usb2_dev/usb3_dev while the connector is still valid, so UCSI
> no longer sees a freed USB device.
>
> Upstream commit, merged in v7.2-rc5:
> e0b291fe1179 usb: core: port: Deattach Type-C connector on component unbind
>
> Link:
> https://lore.kernel.org/lkml/20260611071201.1235545-1-acelan.kao@canonical.com/
>
> [Test Plan]
> Attach a Thunderbolt dock with an ethernet port to the system.
>
> 1. Unplug and replug the dock 20 times, checking dmesg after each replug:
>     $ sudo dmesg -w | grep -E "igc|typec|kernfs"
>
> 2. Or reboot 20 times with the dock attached and check dmesg after boot:
>     $ sudo dmesg | grep -E "PCIe link lost|Failed to read reg|can not remove 'typec'"
>
> Also check the dock ethernet actually works after each cycle:
>     $ ip link show
>     $ ping -c 3 <gateway>
>
> Without patch: "PCIe link lost, device now detached", "igc: Failed to read
> reg 0x0!" and the igc_rd32 WARNING show up in dmesg, and the dock ethernet
> interface does not come up.
>
> With patch: no such messages in dmesg, and the dock ethernet interface comes
> up every time.
>
> [Where problems could occur]
> Could break USB Type-C connector handling in drivers/usb/core/port.c and the
> typec class.
>
> If typec_deattach() is called on a port that was never attached, or the child
> device is already gone, the Type-C partner sysfs links could be removed too
> early. That would show up as a missing typec symlink under the USB port, or
> as "can not remove" warnings from kernfs on dock unplug. Devices that only
> use the Type-C connector class for USB enumeration, such as USB4/Thunderbolt
> docks and USB-C monitors, are the ones that would notice.
>
> The change is two lines and only runs on the unbind path, so normal
> enumeration is not affected.
>
> Chia-Lin Kao (AceLan) (1):
>    usb: core: port: Deattach Type-C connector on component unbind
>
>   drivers/usb/core/port.c | 2 ++
>   1 file changed, 2 insertions(+)
>
Signed-off-by: Rickey Castillo<rickey.castillo.valenzuela at canonical.com>