Re: [PATCH 2/2] thunderbolt: Validate output ports while discovering paths

[Mika Westerberg <mika.westerberg@linux.intel.com>]

Hi,

On Wed, Sep 09, 2026 at 12:50:40PM +0900, Daehyeon Ko wrote:
> Path discovery reads the six-bit output port number from router HOPS
> configuration space and uses it to index sw->ports at three sites. A
> router can return a number larger than max_port_number and make the
> connection manager read an out-of-bounds tb_port, retain the invalid
> pointer in a path, or pass its embedded HopID allocator to IDA.
> 
> Resolve each output port through a bounded helper. In the construction
> pass, validate the output port before allocating the input HopID so a
> rejected entry needs no additional unwind.

If a router deliberately provides wrong information it can do much worse
things than just mess up with the CM. We should outright deny that thing
from even connecting not trying to fix every possible place where things
can go wrong.

Second thing is that this is path discovery which is now pretty much
debugging tool rather than the default so a regular user never hits this
anyway.

> Fixes: 0414bec5f39a ("thunderbolt: Discover preboot PCIe paths the boot firmware established")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
> ---
>  drivers/thunderbolt/path.c | 27 ++++++++++++++++++++++-----
>  1 file changed, 22 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/thunderbolt/path.c b/drivers/thunderbolt/path.c
> index b2c322e76b8ad..ea72153690dd3 100644
> --- a/drivers/thunderbolt/path.c
> +++ b/drivers/thunderbolt/path.c
> @@ -31,6 +31,17 @@ static void tb_dump_hop(const struct tb_path_hop *hop, const struct tb_regs_hop
>  		    regs->unknown1, regs->unknown2, regs->unknown3);
>  }
>  
> +static struct tb_port *tb_path_hop_out_port(struct tb_switch *sw,
> +					    const struct tb_regs_hop *hop)
> +{
> +	if (hop->out_port > sw->config.max_port_number) {
> +		tb_sw_warn(sw, "hop refers to non-existent port %u\n",
> +			   hop->out_port);
> +		return NULL;
> +	}
> +	return &sw->ports[hop->out_port];
> +}
> +
>  static struct tb_port *tb_path_find_dst_port(struct tb_port *src, int src_hopid,
>  					     int dst_hopid)
>  {
> @@ -54,7 +65,9 @@ static struct tb_port *tb_path_find_dst_port(struct tb_port *src, int src_hopid,
>  		if (!hop.enable)
>  			return NULL;
>  
> -		out_port = &sw->ports[hop.out_port];
> +		out_port = tb_path_hop_out_port(sw, &hop);
> +		if (!out_port)
> +			return NULL;
>  		hopid = hop.next_hop;
>  		port = out_port->remote;
>  	}
> @@ -141,7 +154,9 @@ struct tb_path *tb_path_discover(struct tb_port *src, int src_hopid,
>  		if (!hop.enable)
>  			break;
>  
> -		out_port = &sw->ports[hop.out_port];
> +		out_port = tb_path_hop_out_port(sw, &hop);
> +		if (!out_port)
> +			return NULL;
>  		if (last)
>  			*last = out_port;
>  
> @@ -178,12 +193,14 @@ struct tb_path *tb_path_discover(struct tb_port *src, int src_hopid,
>  			goto err;
>  		}
>  
> -		if (alloc_hopid && tb_port_alloc_in_hopid(p, h, h) < 0)
> +		out_port = tb_path_hop_out_port(sw, &hop);
> +		if (!out_port)
>  			goto err;
> -
> -		out_port = &sw->ports[hop.out_port];
>  		next_hop = hop.next_hop;
>  
> +		if (alloc_hopid && tb_port_alloc_in_hopid(p, h, h) < 0)
> +			goto err;
> +
>  		if (alloc_hopid &&
>  		    tb_port_alloc_out_hopid(out_port, next_hop, next_hop) < 0) {
>  			tb_port_release_in_hopid(p, h);
> -- 
> 2.55.0