[PATCH] thunderbolt: fix bandwidth group reservation indexing

[PATCH] thunderbolt: fix bandwidth group reservation indexing

[raoxu]

From: Xu Rao <raoxu@uniontech.com>

tb_init_bandwidth_groups() initializes each bandwidth group with
"group->index = i + 1", so the valid group index range is
1..MAX_GROUPS.

tb_consumed_dp_bandwidth() uses group->index directly as an index into
group_reserved[], which has MAX_GROUPS elements and is zero-based. This
leaves group_reserved[0] unused and makes group 7 access one element past
the end of the array.

When Group_ID 7 has reserved bandwidth, the condition reads beyond the
end of the array and may also write beyond it. The reserved bandwidth
for Group_ID 7 is not included in the consumed bandwidth sum either.

Convert the Group_ID to a zero-based array index before accessing
group_reserved[].

Fixes: 52a4490e89d7 ("thunderbolt: Reserve released DisplayPort bandwidth for a group for 10 seconds")
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 drivers/thunderbolt/tb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index c69c323e6952..64b481d2b4dd 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -640,8 +640,8 @@ static int tb_consumed_dp_bandwidth(struct tb *tb,
 		 * tunnels in the group).
 		 */
 		group = tunnel->src_port->group;
-		if (group && group->reserved && !group_reserved[group->index])
-			group_reserved[group->index] = group->reserved;
+		if (group && group->reserved && !group_reserved[group->index - 1])
+			group_reserved[group->index - 1] = group->reserved;

 		/*
 		 * Ignore the DP tunnel between src_port and dst_port
--
2.50.1

Re: [PATCH] thunderbolt: fix bandwidth group reservation indexing

[Mika Westerberg]

Hi,

On Mon, Jun 15, 2026 at 05:03:48PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> tb_init_bandwidth_groups() initializes each bandwidth group with
> "group->index = i + 1", so the valid group index range is
> 1..MAX_GROUPS.

That's because group 0 is "reserved".

> tb_consumed_dp_bandwidth() uses group->index directly as an index into
> group_reserved[], which has MAX_GROUPS elements and is zero-based. This
> leaves group_reserved[0] unused and makes group 7 access one element past
> the end of the array.
> 
> When Group_ID 7 has reserved bandwidth, the condition reads beyond the
> end of the array and may also write beyond it. The reserved bandwidth
> for Group_ID 7 is not included in the consumed bandwidth sum either.
> 
> Convert the Group_ID to a zero-based array index before accessing
> group_reserved[].

Let's keep it like that but can you make a patch that makes MAX_GROUPS =
7+1 instead? Thanks!