[PATCH] thunderbolt: Send header-only XDomain properties changed response

[PATCH] thunderbolt: Send header-only XDomain properties changed response

[JaeGwon Go]

Commit 19813551701d ("thunderbolt: xdomain: Avoid potential stack OOB
read") turned struct tb_xdp_properties_changed_response into a union of
struct tb_xdp_error_response and struct tb_xdp_header, so that
tb_xdp_handle_error() can safely read the error field of a received
response. tb_xdp_properties_changed_response() still sends sizeof(res),
so since that commit the response Linux sends is 36 bytes instead of
32: it carries the zeroed error field, and its XDomain length field
says 6 dwords instead of 5. The other responses changed by that commit
are not affected, because their non-error members are already larger
than struct tb_xdp_error_response.

macOS sends this response as the header only. macOS 27.2 (26B123) keeps
re-sending PROPERTIES_CHANGED_REQUEST when it gets the longer response:
after link-up it repeats the request every 1.5 s, ten times, and then
resets the link, about 15 seconds after it came up. thunderbolt-net
logs in and passes traffic before the reset. The same host stayed
connected to the same Mac for about 23 hours while the Mac ran macOS
27.0.1, so the change in behavior came with macOS 27.2.

Send only the header again, as before that commit. The union stays, so
a received response still has room for the error field. Linux
requesters accept the shorter response: tb_xdomain_match() requires
only frame.size >= response_size / 4, and tb_xdp_handle_error() reads
the error field only when the type is ERROR_RESPONSE.

Tested on an ASMedia ASM4242 USB4 host running an Ubuntu 7.0.0-38
kernel, connected to a Mac17,6 running macOS 27.2. With this change
macOS stops re-sending after the first answers, and tracing shows an
8-dword response with length 5, the same as the response macOS sends.
The link has stayed up for over 1.5 hours, about 80 minutes of which
carried a multi-gigabyte transfer every few minutes. Not tested: a
Linux peer, the error response path, and macOS releases other than
27.2.

The analysis, the fix and the tests were done with an AI coding
assistant.

Fixes: 19813551701d ("thunderbolt: xdomain: Avoid potential stack OOB read")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: JaeGwon Go <ceo@logictree.app>
---
 drivers/thunderbolt/xdomain.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
index b187a60..563a8b6 100644
--- a/drivers/thunderbolt/xdomain.c
+++ b/drivers/thunderbolt/xdomain.c
@@ -509,8 +509,8 @@ tb_xdp_properties_changed_response(struct tb_ctl *ctl, u64 route, u8 sequence)
 
 	memset(&res, 0, sizeof(res));
 	tb_xdp_fill_header(&res.hdr, route, sequence,
-			   PROPERTIES_CHANGED_RESPONSE, sizeof(res));
-	return __tb_xdomain_response(ctl, &res, sizeof(res),
+			   PROPERTIES_CHANGED_RESPONSE, sizeof(res.hdr));
+	return __tb_xdomain_response(ctl, &res.hdr, sizeof(res.hdr),
 				     TB_CFG_PKG_XDOMAIN_RESP);
 }
 
-- 
2.54.0 (Apple Git-157)

Re: [PATCH] thunderbolt: Send header-only XDomain properties changed response

[sashiko-bot]

> Commit 19813551701d ("thunderbolt: xdomain: Avoid potential stack OOB
> read") turned struct tb_xdp_properties_changed_response into a union of
> struct tb_xdp_error_response and struct tb_xdp_header, so that
> tb_xdp_handle_error() can safely read the error field of a received
> response. tb_xdp_properties_changed_response() still sends sizeof(res),
> so since that commit the response Linux sends is 36 bytes instead of
> 32: it carries the zeroed error field, and its XDomain length field
> says 6 dwords instead of 5. The other responses changed by that commit
> are not affected, because their non-error members are already larger
> than struct tb_xdp_error_response.
> 
> macOS sends this response as the header only. macOS 27.2 (26B123) keeps
> re-sending PROPERTIES_CHANGED_REQUEST when it gets the longer response:
> after link-up it repeats the request every 1.5 s, ten times, and then
> resets the link, about 15 seconds after it came up. thunderbolt-net
> [ ... ]
> 
> Fixes: 19813551701d ("thunderbolt: xdomain: Avoid potential stack OOB read")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: JaeGwon Go <ceo@logictree.app>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261029081834.91559-1-ceo@logictree.app?part=1