From: Mika Westerberg <mika.westerberg@linux.intel.com>
To: raoxu <raoxu@uniontech.com>
Cc: andreas.noever@gmail.com, westeri@kernel.org,
YehezkelShB@gmail.com, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] thunderbolt: fix bandwidth group reservation indexing
Date: Tue, 23 Jun 2026 14:12:50 +0200 [thread overview]
Message-ID: <20260623121250.GC3066@black.igk.intel.com> (raw)
In-Reply-To: <1ACD3C00B2C83FD0+20260615090348.3058017-1-raoxu@uniontech.com>
Hi,
On Mon, Jun 15, 2026 at 05:03:48PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
>
> tb_init_bandwidth_groups() initializes each bandwidth group with
> "group->index = i + 1", so the valid group index range is
> 1..MAX_GROUPS.
That's because group 0 is "reserved".
> tb_consumed_dp_bandwidth() uses group->index directly as an index into
> group_reserved[], which has MAX_GROUPS elements and is zero-based. This
> leaves group_reserved[0] unused and makes group 7 access one element past
> the end of the array.
>
> When Group_ID 7 has reserved bandwidth, the condition reads beyond the
> end of the array and may also write beyond it. The reserved bandwidth
> for Group_ID 7 is not included in the consumed bandwidth sum either.
>
> Convert the Group_ID to a zero-based array index before accessing
> group_reserved[].
Let's keep it like that but can you make a patch that makes MAX_GROUPS =
7+1 instead? Thanks!
prev parent reply other threads:[~2026-06-23 12:12 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-15 9:03 [PATCH] thunderbolt: fix bandwidth group reservation indexing raoxu
2026-06-23 12:12 ` Mika Westerberg [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260623121250.GC3066@black.igk.intel.com \
--to=mika.westerberg@linux.intel.com \
--cc=YehezkelShB@gmail.com \
--cc=andreas.noever@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=raoxu@uniontech.com \
--cc=westeri@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.