From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f47.google.com (mail-qv1-f47.google.com [209.85.219.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1E0C3E5579 for ; Mon, 25 May 2026 09:29:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779701342; cv=none; b=fQaqq8GMHfw02HAnXnwW7TVY/6r5QGRkt89AKFuk4dTRxcCWSd8zFvKmD95//Gnt+gWDFp83UF5KZdRPbZcgxJNCMeRCVqJBbiaLnXS8L1r/+3Jh4R/r/9ymJJQtbCsPtQdTSbmlAHotPiwhijA1hJAZPNttiZuQUQgCt39+3EE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779701342; c=relaxed/simple; bh=oRcRReuuL2uOsa8tofODlTfTr2wFpNOKYmsL6dymuwE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fIFNZLwpPpRAXaGfLO3ziAVeas4dVm0n31vRMDZN5/VkdIRTUrI4ZIf0MYuo8mLmN9nIQ/fs5IhtFxuIOvx7l9PRqQQirpsQIusoM453xz0vZ2Bp0KbIUedFZRp4ur5kDe6AnGtLASDg281XBy/fF8QroDRUMjJxHcgFnSoV4fQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=slEtP1tM; arc=none smtp.client-ip=209.85.219.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="slEtP1tM" Received: by mail-qv1-f47.google.com with SMTP id 6a1803df08f44-8b5232009a6so137277386d6.1 for ; Mon, 25 May 2026 02:29:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779701340; x=1780306140; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=rs/GTZf77euP8CWwg6koAQaKj3q73D7iZ013TlHvejo=; b=slEtP1tMOWiJaZUTZsMksdc0PjOqGDLsMuFcY+45DkSNxiem5aS+KNzJ5DveQq3e9z zcW+u3S3bG96VSYxbpRcL5WgfG5vXwiZiwXClI4e+AMbdujhNBoVjU3+SKLj+1lVkjaR nHAwDv5rMRLM8efEhUEm4+a0tBtrmeqKMMrFk3NrixqstA8CIkvL67O+7QcMpE1StxVa 7FbI9QAMpoq9SUxcaVJIvSh58nJ060LJiBexutIYVoTwSmNGRG5fbS/Tu0c6+R7/1n4b s608vswccEIwfJYABl1YXRjUA+ZypYrj4lteu32rDh1dFED2wwXdvQVJzrfCUBcnfAaR nEBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779701340; x=1780306140; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=rs/GTZf77euP8CWwg6koAQaKj3q73D7iZ013TlHvejo=; b=FrKBa49VPk44klI8H0QDsiGZwQ6Ss8FoWTXinV3RPkGK+zKH8zy9L/EA7JWjToOirl EGQfG6THSq9PpUoJuJFPKLy4G+lqxDKZBXo/tTjSCNLYmBNXzBE0T8Rkh6tbDLnD5nUQ h6yR6Pbh3b6fCuCJ0fH8kcTXcSdRa8n9Wis0ONf4D4HKLmUSCjkxUSJdj/oLKNO/Sifz vQ9FIh5j2+2LfuPFQCfePWohbvvCArcto9YUGUxMj2uEp8n7WBr+3qQvZ7HRX1jKPG0U D5dxqKQe8al3a1Wtf94jdnu73Jp6BOINaVzLGB2zOGfJwrCahXWF+5vPOdyEzBOey9vZ DuXw== X-Forwarded-Encrypted: i=1; AFNElJ+nTQX54xerjGqOehQBarQP6T0iQMXo54dt00vtv5PP0IAw7mnqb+IKw9tO98BH5mwTvcmiNV5c3my7ELs=@vger.kernel.org X-Gm-Message-State: AOJu0Yw2ZXj3CAeKwZKY15VsM7hR9l0U/k2vokkoeU8XPYLGbxc1+tcW isfe5RIK6Zl2BTYUfo9XJL5WoC/KbR6UvJH7P0FfB0ECHZLCVWDOxUVj X-Gm-Gg: Acq92OEY9HO3ANiMtw6OZTdgNCCWBUvsBKbOs+c88tzhUbt2ddYyxnpOVUUIVRndTUr qn+SvpkRTu+mcgOJDPewckNHss0uA2xmD++mUQy4bazQi3FhYBoAX8lQoBYvYDtORcu/uHHOuSy QcZGAZ77TiD57LZOxTFsHZpFo3A5XvlPMX4Ygl/EQRyHq1JeNJX9Q+BRI+wccfHaXaztrNTRLsU 8XTky8K4LCXuRS7Uk/ELzKXyvsR+Qz9DZ4Vj6wylnqjFuPSeS8h4WrCkfNPuZKAXUHdhr5M4Ktg 2bRQv6hIbhXBX04+RK4BDsavtLYe9oGB/xDXG2RPZrxPHnTt3ERHWcGFiuUnT4cJQwAGhC/LM++ Lzw2Dc0+9UCTk0NADFXLyPDaCU13vgWa97IFVwrbxbcUCmUcHCJCBa19s429HOZeisf3lNu3Snq /QuyKxEdwfAS0ANhF4AOLhnlQifODSmCdWx3dzM0NEmiGuvbRKdOAS8m1LspucIlMmGesbPMKYQ ZRi7+QwBfpD5aqRAwjbEUBJZCYN2PYKFla+5keejaA= X-Received: by 2002:a05:6214:300e:b0:8ca:164c:a861 with SMTP id 6a1803df08f44-8cc7b4ec38emr247568386d6.2.1779701339783; Mon, 25 May 2026 02:28:59 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8cc80dcf4a9sm104255826d6.2.2026.05.25.02.28.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2026 02:28:59 -0700 (PDT) From: Michael Bommarito To: Mika Westerberg , Andreas Noever , Yehezkel Bernat Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/6] thunderbolt: reject zero-length property entries in validator Date: Mon, 25 May 2026 05:28:25 -0400 Message-ID: <20260525092830.735472-2-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260525092830.735472-1-michael.bommarito@gmail.com> References: <20260525092830.735472-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the null-termination logic: property->value.text[property->length * 4 - 1] = '\0'; When property->length is 0 this writes to offset -1 relative to the allocation. Reject zero-length entries early in the validator since they have no valid representation in the XDomain property protocol. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito --- drivers/thunderbolt/property.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/thunderbolt/property.c b/drivers/thunderbolt/property.c index da2c59a17db5c..5cbc1c4f159c2 100644 --- a/drivers/thunderbolt/property.c +++ b/drivers/thunderbolt/property.c @@ -60,6 +60,8 @@ static bool tb_property_entry_valid(const struct tb_property_entry *entry, case TB_PROPERTY_TYPE_DIRECTORY: case TB_PROPERTY_TYPE_DATA: case TB_PROPERTY_TYPE_TEXT: + if (!entry->length) + return false; if (entry->length > block_len) return false; if (check_add_overflow(entry->value, entry->length, &end) || base-commit: 928abe19fbf0127003abcb1ea69cabc1c897d0ab -- 2.53.0