[PATCH v2] thunderbolt: Validate DP bandwidth notification port

[Daehyeon Ko <4ncienth@gmail.com>]

The port number in a DP bandwidth notification is six bits wide and
comes from the router. A router whose maximum port number is smaller can
therefore make tb_handle_dp_bandwidth_request() index beyond the
max_port_number + 1 entries allocated for sw->ports. The first
tb_port_is_dpin() check then reads the out-of-bounds object.

Add a common helper that warns and rejects out-of-range port numbers,
and use it before dereferencing the notification port.

Fixes: 6ce3563520be ("thunderbolt: Add support for DisplayPort bandwidth allocation mode")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---
Changes in v2:
- Add tb_switch_port() and use it for both tb_port_at() and the DP
  bandwidth notification lookup, as requested by Mika.
- Submit the DP bandwidth fix alone; the path-discovery change is not
  included.

 drivers/thunderbolt/tb.c |  4 +++-
 drivers/thunderbolt/tb.h | 11 ++++++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index 47753a5c0f2e..4854735514af 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -2756,7 +2756,9 @@ static void tb_handle_dp_bandwidth_request(struct work_struct *work)
 		goto unlock;
 	}
 
-	in = &sw->ports[ev->port];
+	in = tb_switch_port(sw, ev->port);
+	if (!in)
+		goto put_sw;
 	if (!tb_port_is_dpin(in)) {
 		tb_port_warn(in, "bandwidth request to non-DP IN adapter\n");
 		goto put_sw;
diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h
index 4373336d9425..48dc57250e45 100644
--- a/drivers/thunderbolt/tb.h
+++ b/drivers/thunderbolt/tb.h
@@ -585,14 +585,19 @@ static inline u64 tb_route(const struct tb_switch *sw)
 	return ((u64) sw->config.route_hi) << 32 | sw->config.route_lo;
 }
 
+static inline struct tb_port *tb_switch_port(struct tb_switch *sw, u8 port)
+{
+	if (WARN_ON(port > sw->config.max_port_number))
+		return NULL;
+	return &sw->ports[port];
+}
+
 static inline struct tb_port *tb_port_at(u64 route, struct tb_switch *sw)
 {
 	u8 port;
 
 	port = route >> (sw->config.depth * 8);
-	if (WARN_ON(port > sw->config.max_port_number))
-		return NULL;
-	return &sw->ports[port];
+	return tb_switch_port(sw, port);
 }
 
 static inline const char *tb_width_name(enum tb_link_width width)

base-commit: 50d05c7c76c96b90462f24debacca971d2e86713
-- 
2.55.0