[PATCH v3 0/2] thunderbolt: validate DROM entry extents

[PATCH v3 0/2] thunderbolt: validate DROM entry extents

[Pengpeng Hou]

The generic DROM walker can read a two-byte entry header from a one-byte
tail and accepts an entry whose declared length is shorter than that
header.  Separately, the USB4 product descriptor parser reads a complete
struct tb_drom_entry_desc without requiring that structure to be present.

Split those contracts into two patches.  The descriptor check now uses
sizeof(*desc), as requested by Mika Westerberg, instead of spelling out
the fields manually.

Changes since v2:
https://lore.kernel.org/all/20260731141700.3-thunderbolt-v2-pengpeng@iscas.ac.cn/
- split the generic entry and USB4 descriptor checks
- validate the USB4 entry with sizeof(*desc)
- rebase and re-review against the current tree

The series was reviewed statically. I did not test it with malformed
device DROM data.

Pengpeng Hou (2):
  thunderbolt: require complete DROM entry headers
  thunderbolt: validate USB4 product descriptor entry size

 drivers/thunderbolt/eeprom.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a

-- 
2.50.1 (Apple Git-155)

[PATCH v3 1/2] thunderbolt: require complete DROM entry headers

[Pengpeng Hou]

tb_drom_parse_entries() checks for one byte remaining before reading a
DROM entry header, but the header occupies two bytes. It also accepts a
declared length of one byte.

A one-byte tail consequently makes the parser read entry->len outside
the DROM. A one-byte generic string entry reaches the subtype parser and
underflows its payload-length calculation.

Require a complete entry header before reading it and require the
declared entry length to cover that header. Use subtraction-based bounds
checks so the firmware-provided length cannot overflow the DROM extent
calculation.

Fixes: cd22e73bdf5e ("thunderbolt: Read port configuration from eeprom.")
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/thunderbolt/eeprom.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 2a13fa6888ba..52d654048f07 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -421,9 +421,16 @@ static int tb_drom_parse_entries(struct tb_switch *sw, size_t header_size)
 	int res;
 
 	while (pos < drom_size) {
-		struct tb_drom_entry_header *entry = (void *) (sw->drom + pos);
-		if (pos + 1 == drom_size || pos + entry->len > drom_size
-				|| !entry->len) {
+		struct tb_drom_entry_header *entry;
+
+		if (drom_size - pos < sizeof(*entry)) {
+			tb_sw_warn(sw, "DROM buffer overrun\n");
+			return -EIO;
+		}
+
+		entry = (void *)(sw->drom + pos);
+		if (entry->len < sizeof(*entry) ||
+		    entry->len > drom_size - pos) {
 			tb_sw_warn(sw, "DROM buffer overrun\n");
 			return -EIO;
 		}
-- 
2.50.1 (Apple Git-155)

[PATCH v3 2/2] thunderbolt: validate USB4 product descriptor entry size

[Pengpeng Hou]

The USB4 product descriptor parser casts a generic DROM entry to
struct tb_drom_entry_desc and reads its vendor and product identifiers
without requiring the entry to contain that structure.

A descriptor whose declared length covers only the generic entry header
therefore makes those field reads cross the entry boundary. Require the
entry to contain the descriptor structure before accessing it.

Fixes: b04079837b20 ("thunderbolt: Add initial support for USB4")
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/thunderbolt/eeprom.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 52d654048f07..6b83232b6bf4 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -348,6 +348,11 @@ static int tb_drom_parse_entry_generic(struct tb_switch *sw,
 		const struct tb_drom_entry_desc *desc =
 			(const struct tb_drom_entry_desc *)entry;
 
+		if (header->len < sizeof(*desc)) {
+			tb_sw_warn(sw, "USB4 product descriptor entry is too short\n");
+			return -EIO;
+		}
+
 		if (!sw->vendor && !sw->device) {
 			sw->vendor = desc->idVendor;
 			sw->device = desc->idProduct;
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v3 0/2] thunderbolt: validate DROM entry extents

[Mika Westerberg]

Hi,

On Thu, Aug 13, 2026 at 11:22:06PM +0800, Pengpeng Hou wrote:
> The generic DROM walker can read a two-byte entry header from a one-byte
> tail and accepts an entry whose declared length is shorter than that
> header.  Separately, the USB4 product descriptor parser reads a complete
> struct tb_drom_entry_desc without requiring that structure to be present.
> 
> Split those contracts into two patches.  The descriptor check now uses
> sizeof(*desc), as requested by Mika Westerberg, instead of spelling out
> the fields manually.
> 
> Changes since v2:
> https://lore.kernel.org/all/20260731141700.3-thunderbolt-v2-pengpeng@iscas.ac.cn/
> - split the generic entry and USB4 descriptor checks
> - validate the USB4 entry with sizeof(*desc)
> - rebase and re-review against the current tree
> 
> The series was reviewed statically. I did not test it with malformed
> device DROM data.
> 
> Pengpeng Hou (2):
>   thunderbolt: require complete DROM entry headers
>   thunderbolt: validate USB4 product descriptor entry size

I dropped the Fixes tag, I think these are more like improvements. In
addition I changed the first patch to use const where possible. Please
check that it makes sense for you.

Both applied to thunderbolt.git/next, thanks!

Re: [PATCH v3 0/2] thunderbolt: validate DROM entry extents

[Mika Westerberg]

Hi,

On Mon, Aug 31, 2026 at 08:52:58AM +0200, Mika Westerberg wrote:
> Hi,
> 
> On Thu, Aug 13, 2026 at 11:22:06PM +0800, Pengpeng Hou wrote:
> > The generic DROM walker can read a two-byte entry header from a one-byte
> > tail and accepts an entry whose declared length is shorter than that
> > header.  Separately, the USB4 product descriptor parser reads a complete
> > struct tb_drom_entry_desc without requiring that structure to be present.
> > 
> > Split those contracts into two patches.  The descriptor check now uses
> > sizeof(*desc), as requested by Mika Westerberg, instead of spelling out
> > the fields manually.
> > 
> > Changes since v2:
> > https://lore.kernel.org/all/20260731141700.3-thunderbolt-v2-pengpeng@iscas.ac.cn/
> > - split the generic entry and USB4 descriptor checks
> > - validate the USB4 entry with sizeof(*desc)
> > - rebase and re-review against the current tree
> > 
> > The series was reviewed statically. I did not test it with malformed
> > device DROM data.
> > 
> > Pengpeng Hou (2):
> >   thunderbolt: require complete DROM entry headers
> >   thunderbolt: validate USB4 product descriptor entry size
> 
> I dropped the Fixes tag, I think these are more like improvements. In
> addition I changed the first patch to use const where possible. Please
> check that it makes sense for you.
> 
> Both applied to thunderbolt.git/next, thanks!

Now I actualy tested this and this:

  thunderbolt: validate USB4 product descriptor entry size

fails now on my test system, I think because the structure is actually
larger due to alignment and so. Dropped this patch now. If you want to
revisit then I think the correct check is against what the spec says for
this entry (e.g it must be 15).