From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f42.google.com (mail-qv1-f42.google.com [209.85.219.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8A9463E5A36 for ; Mon, 25 May 2026 09:29:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779701349; cv=none; b=m90+jxoD/OiIJyKEzmrP4OxTMPdiTSTKBKr8KvZW0r2UPoO11V06S6fTF2U7cB54kWCHpk4nEe4ChBP2AvquuETfx4E4a85Z+jYnzXJ2t+vXXjpL7RRtR2rPWHetePgbXQfxuZyHq3T0bkUNnPvTtDcC6mbi2t6ifJS1/agiIvI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779701349; c=relaxed/simple; bh=rIT61GM5oNN2rhJVeEs8hIYSGWUY3khADL2DBDHXiV0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ukdrv+4+kICIBhnO6oWsOlI95Y9N9zGkGtvRLP8V+qcZmaP6HDje7+8ppwf3q5CXaJ71gBi7gAo9pZS5sTjHodXTSQoByTyBHIRF5d4/0+jPRtnsI5PF3c7Db/yUZdXyiRdcsAh/OuWeTY1NKh31/r6bkCeEKk3g91+xz1SmicE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kGT201i7; arc=none smtp.client-ip=209.85.219.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kGT201i7" Received: by mail-qv1-f42.google.com with SMTP id 6a1803df08f44-8b701756684so110501486d6.1 for ; Mon, 25 May 2026 02:29:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779701342; x=1780306142; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=FtiLYHyRBPw0HAjBkMfw5Y+en0r+h/6dV9A2hz2IT/Q=; b=kGT201i7jgiKFTzF8KBK3TEXtod3LyTianQSQcmBW/ji3GdwWQzk2tV64yfKm/wqkB ApE5pM9OjqEjNSEm+cK9y0eEWdH/YW079ZakwwSa1/20CmPqu/3GpGEKOk7GfqUCxCw8 KtSm2X6ViPXYBnPC21o4PDjYeAL50C43AZwIB+KWjBe53gMtb6DrPh4ro6QWs9UHF0v9 Jqroy3R2R3Ro7DXjchoDIMLB8bf1qxMZuJTk0WHD77K0Uv02LlHnRHBhPMIMGdnSJj4Q SRiXZmOBijvR2qHJUB0YkYuf+Z8a/egc3NT+3skQEF0B10ufGHeVlytRqwF5VhA+IeUw 9FzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779701342; x=1780306142; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=FtiLYHyRBPw0HAjBkMfw5Y+en0r+h/6dV9A2hz2IT/Q=; b=H/JCRgw4jYNsv7UdBMCgI7+gHMYy4WvdjAjclNzPZa/BWTgKAOirnLhrjKv8af9wL5 pKFc0p4MbuUDwkU2eQohEk4hj6s1qzXXzG7uAHWKOXxTf+F4MSdyrPmTQJKpGLrDF/+t v5rUk1I++Ap6A4JCX2Gk2QPWswBGCjyQO+Fi7MUQSILuBeVIY7miyGCWf8yPVkyiG3Md FNVs6tOQU055LMl7gfIruXcwDMCa8U3jJJYS+PPFsAzp4Wl0nAWIunO3C5yzb0Tysw+c AbRZKiImecJDVIsw/jYQXMmyJ/tvRy4gx4yXJf8wbKESOZcXkamkeip1LsSRiG13PQsz nXRA== X-Forwarded-Encrypted: i=1; AFNElJ/GuW3WfodmvpoZFxnmgaxNrrlBJNJVF2FN3RbW5RgGY8EaN4b+pQQII8t53I8o5gdM+eAoQkR4mzNNbK8=@vger.kernel.org X-Gm-Message-State: AOJu0YzI243w92dR25vHc+whBNj0vrShH0gqPNZobsa+H2JocpHch1+C 6YVFYaYXhT9di64YjH92YO6IUbZpti2lrVv5+Kap1tDmMHzEVKwS7JRShyXRck80 X-Gm-Gg: Acq92OFToF3IyCvixmwoLqcc7asSyLtX5bSGwLfAVcBQuIZOBG/qYqYkjJsFsak5kfN cSxuei9rVVzUAJ/M6iph8KeDhpvGNahX4nQhKFIhg4acXJl4uKxf8ImuVY05dWqwx2k1y7YEQux c/rJd52XD47rqFpCNfwabHrhGJocc2zjIAP22cmkf2rC0yOq+v8W2CLvj8yotIYaT46jTAZtUbC IVLHbR8ZNAyc6ThNpSz1A41NipGBMGIJuQovbxTXWRylwi/2Tq9vadfIDkaldITslwrjL2KG3On tbVlAn5NF29qqUkXcQR253++ajeRu39f5masAyziQs+WcLHnibe1wRUqVHyhrf1+zdgfisQdQIp LUUctq6cifJsxucfFXs9JPMFA2zmmMt9PS6zYknuixIaNJO7aSUGGzUGtYoojWXX6pyYwKjaAbD AUqucjbIjrvkTEvRfC0dwWNbp85MR3g4h0JsEd0ScYmkP+IlUuBzHw/rnBSBrmCFV02ctprVfhD k+nkG1tcl8ksXyIXAxfHjXfuq44Z0XjPgc7dBFealX8Mhgp4flmgQ== X-Received: by 2002:ad4:576d:0:b0:8ac:a91c:c8d with SMTP id 6a1803df08f44-8cc7becc39emr183880176d6.14.1779701342486; Mon, 25 May 2026 02:29:02 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8cc80dcf4a9sm104255826d6.2.2026.05.25.02.29.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2026 02:29:02 -0700 (PDT) From: Michael Bommarito To: Mika Westerberg , Andreas Noever , Yehezkel Bernat Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 4/6] thunderbolt: validate XDomain request packet size before type cast Date: Mon, 25 May 2026 05:28:28 -0400 Message-ID: <20260525092830.735472-5-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260525092830.735472-1-michael.bommarito@gmail.com> References: <20260525092830.735472-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast. Fixes: 8e1de7042596 ("thunderbolt: Add support for XDomain lane bonding") Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito --- Stock KASAN splat reproduced on QEMU (7.1.0-rc3). A test module allocates a 32-byte packet (tb_xdp_header only) and casts to tb_xdp_link_state_change (36 bytes). The read past the allocation fires immediately: BUG: KASAN: slab-out-of-bounds in tb_test_xdp_short_packet_cast_trigger.cold+0x118/0x12d Read of size 1 at addr ffff888002110260 located 0 bytes to the right of allocated 32-byte region Also exercised over Thunderbolt 4 cable with 258 truncated-packet injections (PROPERTIES_REQUEST 68 -> 32 bytes). drivers/thunderbolt/xdomain.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c index 4099419c74795..9d54e3ccc8278 100644 --- a/drivers/thunderbolt/xdomain.c +++ b/drivers/thunderbolt/xdomain.c @@ -55,6 +55,7 @@ static const char * const state_names[] = { struct xdomain_request_work { struct work_struct work; struct tb_xdp_header *pkg; + size_t pkg_len; struct tb *tb; }; @@ -733,6 +734,7 @@ static void tb_xdp_handle_request(struct work_struct *work) struct xdomain_request_work *xw = container_of(work, typeof(*xw), work); const struct tb_xdp_header *pkg = xw->pkg; const struct tb_xdomain_header *xhdr = &pkg->xd_hdr; + size_t pkg_len = xw->pkg_len; struct tb *tb = xw->tb; struct tb_ctl *ctl = tb->ctl; struct tb_xdomain *xd; @@ -764,7 +766,7 @@ static void tb_xdp_handle_request(struct work_struct *work) switch (pkg->type) { case PROPERTIES_REQUEST: tb_dbg(tb, "%llx: received XDomain properties request\n", route); - if (xd) { + if (xd && pkg_len >= sizeof(struct tb_xdp_properties)) { ret = tb_xdp_properties_response(tb, ctl, xd, sequence, (const struct tb_xdp_properties *)pkg); } @@ -818,7 +820,8 @@ static void tb_xdp_handle_request(struct work_struct *work) tb_dbg(tb, "%llx: received XDomain link state change request\n", route); - if (xd && xd->state == XDOMAIN_STATE_BONDING_UUID_HIGH) { + if (xd && xd->state == XDOMAIN_STATE_BONDING_UUID_HIGH && + pkg_len >= sizeof(struct tb_xdp_link_state_change)) { const struct tb_xdp_link_state_change *lsc = (const struct tb_xdp_link_state_change *)pkg; @@ -870,6 +873,7 @@ tb_xdp_schedule_request(struct tb *tb, const struct tb_xdp_header *hdr, kfree(xw); return false; } + xw->pkg_len = size; xw->tb = tb_domain_get(tb); schedule_work(&xw->work); -- 2.53.0