[PATCH] thunderbolt: debugfs: fix sideband write size check

[PATCH] thunderbolt: debugfs: fix sideband write size check

[raoxu]

From: Xu Rao <raoxu@uniontech.com>

sb_regs_write() looks up the matching sideband register entry before
validating the number of bytes to write.

However, the size check uses sb_regs->size, which is the size of the
first entry in the register table, instead of the matched entry. This
rejects valid writes to larger sideband registers such as USB4_SB_DEBUG
or USB4_SB_DATA.

Use the matched register entry for the size check.

Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 drivers/thunderbolt/debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thunderbolt/debugfs.c b/drivers/thunderbolt/debugfs.c
index 25f6ea6ea094..45ec31e2d040 100644
--- a/drivers/thunderbolt/debugfs.c
+++ b/drivers/thunderbolt/debugfs.c
@@ -366,7 +366,7 @@ static ssize_t sb_regs_write(struct tb_port *port, const struct sb_reg *sb_regs,
 		if (!sb_reg)
 			return -EINVAL;
 
-		if (bytes_read > sb_regs->size)
+		if (bytes_read > sb_reg->size)
 			return -E2BIG;
 
 		ret = usb4_port_sb_write(port, target, index, sb_reg->reg, data,
-- 
2.50.1

Re: [PATCH] thunderbolt: debugfs: fix sideband write size check

[Mika Westerberg]

On Mon, Jun 08, 2026 at 02:31:47PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> sb_regs_write() looks up the matching sideband register entry before
> validating the number of bytes to write.
> 
> However, the size check uses sb_regs->size, which is the size of the
> first entry in the register table, instead of the matched entry. This
> rejects valid writes to larger sideband registers such as USB4_SB_DEBUG
> or USB4_SB_DATA.
> 
> Use the matched register entry for the size check.
> 
> Signed-off-by: Xu Rao <raoxu@uniontech.com>

Applied to thunderbolt.git/next, thanks!