[PATCH v2 0/4] thunderbolt: harden XDomain property parser

Michael Bommarito
2026-04-15T12:32:26Z

Three independent memory-safety defects in drivers/thunderbolt/property.c
are reachable when an untrusted Thunderbolt/USB4 XDomain peer responds
to a PROPERTIES_REQUEST during host-to-host discovery. The peer
supplies up to TB_XDP_PROPERTIES_MAX_LENGTH (500) dwords of attacker-
controlled property block which the local host passes to
tb_property_parse_dir() as part of the control-plane exchange that
runs before any tunnels are set up.

Patches 1-3 are one bug per patch: u32 overflow in
tb_property_entry_valid(), size_t underflow on dir_len < 4 in
__tb_property_parse_dir(), and unbounded recursion in the same.
Patch 4 is three KUnit regression cases exercising all three.
Let me know if you want me to pair the KUnit cases with each
patch instead.

My assessment is that all three defects are OOB-read or DoS
at worst. No controlled OOB write is reachable through the
parser; parse_dwdata()'s destination is a freshly kcalloc'd
buffer sized by entry->length.

As Mika noted, operators who do not need XDomain
host-to-host discovery can disable the path entirely with
thunderbolt.xdomain=0 on the kernel command line.

Reproduced on v7.0-rc7 + CONFIG_KASAN=y + CONFIG_USB4_KUNIT_TEST=y
via the KUnit suite in patch 4. Pre-fix, each case oopses inside
__tb_property_parse_dir (KASAN shadow-memory fault for u32-wrap,
stack-guard trip for recursion, OOB read past block for dir_len
underflow). Post-fix, all three pass without issue.

Changes since v1
----------------

v1 -> v2, addressing Mika's review (msgid
20260415045246.GR3552@black.igk.intel.com):

- Split the single property.c hardening patch into three, one per
bug, ordered smallest-diff-first (u32 wrap, then dir_len
underflow, then recursion cap). [Mika]
- Removed the incorrect "PCIe tunnel authorization" framing from
the commit messages and cover letter. XDomain discovery runs
before any tunnel is set up; the path is not PCIe-specific.
[Mika]
- Added an explicit operator mitigation note
(thunderbolt.xdomain=0). [Mika]
- Trimmed the commit messages: dropped the per-file prior-fix
enumeration (Kangjie Lu 2019 series, Alan Borzeszkowski 2025
cleanup) and the lei / Patchwork / westeri-tree scoop-check
provenance notes; that content is available via git log -p and
does not belong in the commit message. [Mika]
- Dropped the long inline block comments above check_add_overflow(),
the TB_PROPERTY_MAX_DEPTH check, the INIT_LIST_HEAD reorder, and
the dir_len < 4 reject; the code is self-explanatory given the
commit message. [Mika]
- Reworded the recursion DoS description away from "remote" (this
is a peer-triggered DoS reachable from any adjacent XDomain peer
over the Thunderbolt/USB4 bus, not network-reachable).
- KUnit patch unchanged in content; commit message adjusted to say
"sibling commits" rather than "parent commit" now that the series
has multiple parent fixes.

Michael Bommarito (4):
thunderbolt: property: reject u32 wrap in tb_property_entry_valid()
thunderbolt: property: reject dir_len < 4 to prevent size_t underflow
thunderbolt: property: cap recursion depth in
__tb_property_parse_dir()
thunderbolt: test: add KUnit regression tests for XDomain property
parser

drivers/thunderbolt/property.c | 32 ++++++---
drivers/thunderbolt/test.c | 127 +++++++++++++++++++++++++++++++++
2 files changed, 150 insertions(+), 9 deletions(-)

--
2.53.0