[PATCH] thunderbolt: validate DROM entry lengths

[PATCH] thunderbolt: validate DROM entry lengths

[Pengpeng Hou]

From: Pengpeng <pengpeng@iscas.ac.cn>

tb_drom_parse_entries() checks that a DROM entry does not run past the
end of the DROM, but it did not require the declared entry length to
cover the entry header itself.

Require each entry to contain its two-byte header before dispatching to
the type-specific DROM entry parsers.

Signed-off-by: Pengpeng <pengpeng@iscas.ac.cn>
---
 drivers/thunderbolt/eeprom.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 5681c17f82ec..270bb34aff42 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -414,9 +414,15 @@ static int tb_drom_parse_entries(struct tb_switch *sw, size_t header_size)
 	int res;
 
 	while (pos < drom_size) {
-		struct tb_drom_entry_header *entry = (void *) (sw->drom + pos);
-		if (pos + 1 == drom_size || pos + entry->len > drom_size
-				|| !entry->len) {
+		struct tb_drom_entry_header *entry;
+
+		if (drom_size - pos < sizeof(*entry)) {
+			tb_sw_warn(sw, "DROM buffer overrun\n");
+			return -EIO;
+		}
+
+		entry = (void *)(sw->drom + pos);
+		if (entry->len < sizeof(*entry) || entry->len > drom_size - pos) {
 			tb_sw_warn(sw, "DROM buffer overrun\n");
 			return -EIO;
 		}
-- 
2.43.0

Re: [PATCH] thunderbolt: validate DROM entry lengths

[Mika Westerberg]

On Mon, Jul 06, 2026 at 05:15:32PM +0800, Pengpeng Hou wrote:
> From: Pengpeng <pengpeng@iscas.ac.cn>
> 
> tb_drom_parse_entries() checks that a DROM entry does not run past the
> end of the DROM, but it did not require the declared entry length to
> cover the entry header itself.
> 
> Require each entry to contain its two-byte header before dispatching to
> the type-specific DROM entry parsers.
> 
> Signed-off-by: Pengpeng <pengpeng@iscas.ac.cn>

Can you add your full name to the From and SoB?

> ---
>  drivers/thunderbolt/eeprom.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
> index 5681c17f82ec..270bb34aff42 100644
> --- a/drivers/thunderbolt/eeprom.c
> +++ b/drivers/thunderbolt/eeprom.c
> @@ -414,9 +414,15 @@ static int tb_drom_parse_entries(struct tb_switch *sw, size_t header_size)
>  	int res;
>  
>  	while (pos < drom_size) {
> -		struct tb_drom_entry_header *entry = (void *) (sw->drom + pos);
> -		if (pos + 1 == drom_size || pos + entry->len > drom_size
> -				|| !entry->len) {
> +		struct tb_drom_entry_header *entry;
> +
> +		if (drom_size - pos < sizeof(*entry)) {
> +			tb_sw_warn(sw, "DROM buffer overrun\n");
> +			return -EIO;
> +		}
> +
> +		entry = (void *)(sw->drom + pos);
> +		if (entry->len < sizeof(*entry) || entry->len > drom_size - pos) {
>  			tb_sw_warn(sw, "DROM buffer overrun\n");
>  			return -EIO;
>  		}
> -- 
> 2.43.0