[PATCH v3] thunderbolt: fix bandwidth group reservation indexing

[PATCH v3] thunderbolt: fix bandwidth group reservation indexing

[raoxu]

From: Xu Rao <raoxu@uniontech.com>

Group ID 0 is reserved, while valid bandwidth groups use IDs 1 through
7. tb_consumed_dp_bandwidth() uses the Group ID directly to index
its group_reserved[] array.

Currently group_reserved[] has only seven entries, covering indices 0
through 6. A tunnel in Group ID 7 therefore reads and may write one
entry past the end of the array, and that group's reserved bandwidth is
not included in the consumed bandwidth total.

Include the reserved Group ID 0 in MAX_GROUPS and map tb_cm::groups[]
directly by Group ID. Initialize every entry with its array index, but
skip index 0 when allocating a free group or restoring a group reported
by the hardware. This keeps Group ID 0 reserved while making IDs 1
through 7 valid indices in both arrays.

Fixes: 52a4490e89d7 ("thunderbolt: Reserve released DisplayPort bandwidth for a group for 10 seconds")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
Changes in v3:
- Keep tb_cm::groups[] sized with MAX_GROUPS and map its entries
  directly to Group IDs 0 through 7.
- Initialize the reserved Group ID 0 entry, but skip it when allocating
  or discovering usable bandwidth groups.
- Drop the incorrect MAX_GROUPS - 1 sizing from v2.

Changes in v2:
- Keep Group ID as the direct group_reserved[] index instead of
  converting it to a zero-based index as in v1.
- Include the reserved Group ID 0 in MAX_GROUPS.

 drivers/thunderbolt/tb.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index b7cc689..aad09e5 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -41,7 +41,7 @@
  */
 #define TB_ASYM_THRESHOLD	45000

-#define MAX_GROUPS		7	/* max Group_ID is 7 */
+#define MAX_GROUPS		(7 + 1)	/* Group_ID 0 is reserved */

 static unsigned int asym_threshold = TB_ASYM_THRESHOLD;
 module_param_named(asym_threshold, asym_threshold, uint, 0444);
@@ -1585,7 +1585,7 @@ static void tb_init_bandwidth_groups(struct tb_cm *tcm)
 		struct tb_bandwidth_group *group = &tcm->groups[i];

 		group->tb = tcm_to_tb(tcm);
-		group->index = i + 1;
+		group->index = i;
 		INIT_LIST_HEAD(&group->ports);
 		INIT_DELAYED_WORK(&group->release_work,
 				  tb_bandwidth_group_release_work);
@@ -1608,7 +1608,7 @@ static struct tb_bandwidth_group *tb_find_free_bandwidth_group(struct tb_cm *tcm
 {
 	int i;

-	for (i = 0; i < ARRAY_SIZE(tcm->groups); i++) {
+	for (i = 1; i < ARRAY_SIZE(tcm->groups); i++) {
 		struct tb_bandwidth_group *group = &tcm->groups[i];

 		if (list_empty(&group->ports))
@@ -1662,7 +1662,7 @@ static void tb_discover_bandwidth_group(struct tb_cm *tcm, struct tb_port *in,
 		int index, i;

 		index = usb4_dp_port_group_id(in);
-		for (i = 0; i < ARRAY_SIZE(tcm->groups); i++) {
+		for (i = 1; i < ARRAY_SIZE(tcm->groups); i++) {
 			if (tcm->groups[i].index == index) {
 				tb_bandwidth_group_attach_port(&tcm->groups[i], in);
 				return;
--
2.47.3

Re: [PATCH v3] thunderbolt: fix bandwidth group reservation indexing

[Mika Westerberg]

Hi,

On Wed, Jun 24, 2026 at 01:07:19PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> Group ID 0 is reserved, while valid bandwidth groups use IDs 1 through
> 7. tb_consumed_dp_bandwidth() uses the Group ID directly to index
> its group_reserved[] array.
> 
> Currently group_reserved[] has only seven entries, covering indices 0
> through 6. A tunnel in Group ID 7 therefore reads and may write one
> entry past the end of the array, and that group's reserved bandwidth is
> not included in the consumed bandwidth total.
> 
> Include the reserved Group ID 0 in MAX_GROUPS and map tb_cm::groups[]
> directly by Group ID. Initialize every entry with its array index, but
> skip index 0 when allocating a free group or restoring a group reported
> by the hardware. This keeps Group ID 0 reserved while making IDs 1
> through 7 valid indices in both arrays.

I looked at this again and realized that your v1 was almost okay but
instead of the -1 we should do this and just this:

tb_consumed_dp_bandwidth()
{
	 int group_reserved[MAX_GROUPS + 1] = {};
	 ...

keep everything else as is. This should solve the issue, right?