From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f43.google.com (mail-qv1-f43.google.com [209.85.219.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C750F3E5EE2 for ; Mon, 25 May 2026 09:29:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779701343; cv=none; b=i+4crovNCgUGN4qfTus+5OMLsuoC4mZbAiDKCrNSHC2KlInsW9aAW+41lzbmElW1dHG9JXFbi2M1Jq7dKFruuCn2+M58v3GanosWYx6vihCYF4vqbmMibHYkAnGf1ssUwGL4aB0L2iUDiP1vs3FBysfniRLAGTpaafFcgb20qmU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779701343; c=relaxed/simple; bh=v/6rZ1VmN1v3nBRbzYBC6QI9R/AMWWmdAQWVgoLRewc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PdsXGRGIIQwtWNdxHMY1hyzEwowdt/nqNXfLu66e81NHHf3poBH47IGSBaqSUOhWP5cFzCk0dwFPumIrLDQZ0L90UFcBrNRb7ZLH1YtCB23hMEbGR/mCpA65Ss69T9GtWNVybVRtJC+Ifr9mGLu1RVwNeeYDnTC/MaCxzj0qjyc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bX46uY/x; arc=none smtp.client-ip=209.85.219.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bX46uY/x" Received: by mail-qv1-f43.google.com with SMTP id 6a1803df08f44-8b3d6b215cfso163764316d6.3 for ; Mon, 25 May 2026 02:29:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779701341; x=1780306141; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=nUgjwpPNQNXM4+anOpqwS/DzvwIVP/9fFHWONmUgMwY=; b=bX46uY/xcF9bBa16vsMQXdfpTUJ1XerdTV78tz3UH95GGtmQRtN7KGR14khc1yDS+k pw3pMdYLRMv2NS86vK4KD433BLWSE6uZt+dpzzkVVuYDotTXB6n/hdcIS9jIYKNpA6qv 7/PVQ9yya6IATgehbqWmDSWM6FDTRjvPeGD/mp0FxrzkrUU5pk/gRxncAmPoiwNtQL16 HBwIVHCqHcz0Ec75AxHuz4T1CEC4n8krmB4hn95OrYtEXZZCTF5LlfiRBP1YuovtQE8i cUiyD3hj1Y48MoTddmtBG7Nm3Pd6829XsIe7CpYpt7TRu7cfFl0TtBY7qjnQ6hWoG1Mu fLow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779701341; x=1780306141; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=nUgjwpPNQNXM4+anOpqwS/DzvwIVP/9fFHWONmUgMwY=; b=jM9YSuI74Q8vfWMed80dxDSCrqtinaBQR0MwxCisMPvl1pNkhdq5ttN6sbDlrD19bV /unqUZ/hDr/TjNiNFEbRWjvkxy4L9CSf9SVWJVUJGR53s+8ccHdfG9ETfln7QMs9bJOV Pe3RJtNJKtju6hHjUYdmSC3bB9wd9rPqrb4jUHC8gXFS1Oe9Jt1HbuOWQAbpmsKxx4Lx e2isPv5gk7KauTktdU3df9iWFxX+gsEKdSYi20VXb40NqMKudrbpV344lyZIl/MbSlAy zz3WXlFADsKXKY41nIfCmpDpujwjN4AAZs0fVu2vr0OoO6leDJuawYJH3wZ9Umk1q3rJ WoGw== X-Forwarded-Encrypted: i=1; AFNElJ+ZpwGS9XQ8KU9xhAPMF47yziR2bH+HSMcgoYIDIqYjjxXjkvDued7lP48FQwP5qEUNUFwFDAOBZJ+S/IE=@vger.kernel.org X-Gm-Message-State: AOJu0YyzR2uKfjrRgPqs3W8vTExiDfg0ICXy5pR4FlMB2D0rNPWg55Lc xCdov0Rxu36oifkvd94ExDvYbNplOdSvOEwtFzB2d3VTsPxlrzg8UFPJ X-Gm-Gg: Acq92OGR9eNkBjenPXBJ1i6Xf+KpjCUSsek/KYL/OqVll2cK4mFw6lhGHqqyzNSXXrZ Y28guf0h707zxuXHP/l8Pkn18jziIKv0DnH61T466v/IPdNMkV/HRg0UDmXkSBrcjRPwQ1Wukkg pW1jIQ7CanjBcEo9vn4WPxdNjJ/eiq6WDtT86n9XsAJWb6rCgr8zTWg9gy1RGqLiHD4waLmsHvg 6DaTO3LCTk10M0AhKp6NRnGauFFeyMHpLPmdZLNIFaLId5k5EEHLMdV8+yEVSiGVUi7vcwDKSgn FG5nqusY5Vx4Ggdrb4jbebAgPB8YVm+alyqKR9mnm9w3rHzEmGZ4sYO77gw+DwXSVLVKhTu7jKa HCxEOqmmvhNbWEsc+c7EJ6J27u3wdn61hzpTEfgaVez8V6TJ4b132wZReQG9Lfug5FCh8GEkqrZ UDL/IKCm4wFtnO/6c7YYUASkuxTkvb2hMS0XM6uOKCCK5L1Y4qI3mvcRwbDQuCijZzRXMnlJu9b jtsA47VslFb/+4G97InDMkQRcAnaKI7J3H1BBvoQDE= X-Received: by 2002:a05:6214:242c:b0:8bf:6a92:84b2 with SMTP id 6a1803df08f44-8cc7b620b40mr227647156d6.13.1779701340666; Mon, 25 May 2026 02:29:00 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8cc80dcf4a9sm104255826d6.2.2026.05.25.02.28.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2026 02:29:00 -0700 (PDT) From: Michael Bommarito To: Mika Westerberg , Andreas Noever , Yehezkel Bernat Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/6] thunderbolt: bound root directory content to block size Date: Mon, 25 May 2026 05:28:26 -0400 Message-ID: <20260525092830.735472-3-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260525092830.735472-1-michael.bommarito@gmail.com> References: <20260525092830.735472-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing content_offset and content_len to reject directories whose content extends past the block. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito --- drivers/thunderbolt/property.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/thunderbolt/property.c b/drivers/thunderbolt/property.c index 5cbc1c4f159c2..59beab43f90a6 100644 --- a/drivers/thunderbolt/property.c +++ b/drivers/thunderbolt/property.c @@ -187,6 +187,10 @@ static struct tb_property_dir *__tb_property_parse_dir(const u32 *block, if (is_root) { content_offset = dir_offset + 2; content_len = dir_len; + if (content_offset + content_len > block_len) { + tb_property_free_dir(dir); + return NULL; + } } else { if (dir_len < 4) { tb_property_free_dir(dir); -- 2.53.0