Re: [PATCH v2 16/22] thunderbolt: Add add_links to tb_nhi_ops

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Fallback path in tb_probe() blindly casts a generic platform device to a PCI device, leading to a struct mismatch out-of-bounds read.
--

commit c3cbdbc00334a1dc32e8f14d7f05432dee177b2c
Author: Sven Peter <sven@kernel.org>

thunderbolt: Add add_links to tb_nhi_ops

This commit introduces an add_links callback to tb_nhi_ops for platform
drivers to discover and add device links. This enables drivers like the Apple
Silicon one to use device tree connections instead of ACPI or PCI topology.

> diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
> index d2832323cc360..72418a07166e3 100644
> --- a/drivers/thunderbolt/tb.c
> +++ b/drivers/thunderbolt/tb.c
> @@ -3434,7 +3434,8 @@ struct tb *tb_probe(struct tb_nhi *nhi)
>  	 * before the PCIe/USB stack is resumed so complain here if we
>  	 * found them missing.
>  	 */
> -	if (!tb_apple_add_links(nhi) && !tb_acpi_add_links(nhi))
> +	if (!(nhi->ops->add_links && nhi->ops->add_links(nhi)) &&
> +	    !tb_apple_add_links(nhi) && !tb_acpi_add_links(nhi))
>  		tb_warn(tb, "device links to tunneled native ports are missing!\n");

[Severity: Medium]
If a platform driver does not provide add_links or it returns false on an x86
Apple machine, could this fallback logic cause an out-of-bounds read?

Looking at tb_apple_add_links() called here:

static bool tb_apple_add_links(struct tb_nhi *nhi)
{
	struct pci_dev *nhi_pdev = to_pci_dev(nhi->dev);
	...
	if (!x86_apple_machine)
		return false;

	switch (nhi_pdev->device) {
	...

Because this patch opens up tb_probe() to non-PCI platform drivers, passing a
generic platform device to tb_apple_add_links() will result in an invalid
cast via to_pci_dev(). If evaluated on an x86 Apple machine, the subsequent
access to nhi_pdev->device will read out of bounds. 

Is there a way to verify the device is actually a PCI device before calling
tb_apple_add_links()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260906-b4-apple-soc-tbt-v2-0-1f80085f93fb@kernel.org?part=16