From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5AB11318EEE; Mon, 4 May 2026 08:57:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.14 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777885053; cv=none; b=U3tA9nyPBOHv4wvDzusV18fX+9c/Ypc70nEf9KdY7v3VkEdHn2f2x7rveWpTKQ335z+2eluYolXttUA1U/SuJYT6hDcrTMtWdH+EDVbJCz2PHBCHMAllcEMXgJ5cGciQwXABaTKYgqxKyw/1OHikq8711SSXfn79av1e0W7sCkk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777885053; c=relaxed/simple; bh=DCB792sBP7heCFPmc4hb1oWEUUSwNd/IGJYThEbOIUM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=pqPwnGMcK7N8AcwbRPMF0V6MGlihD5lFXD5rOGh/bDNMkCrxfQdjWoGEfnE3ans6FJjI72BIkegoxNVbkMWDK64TMbTND7T5aNYbTxvAhwyZjW236Or7MwMUbEi28TmI+wAn1kfLGPbl4cKIPeP6l8UyPkyYw6NSPauqh2O2qZM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=XbxCgF/W; arc=none smtp.client-ip=192.198.163.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="XbxCgF/W" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1777885053; x=1809421053; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=DCB792sBP7heCFPmc4hb1oWEUUSwNd/IGJYThEbOIUM=; b=XbxCgF/WnvLSLayWKKI+pYFsKeVDTQ10yvUBVCtYeQLvPDfHkYPFZMb4 oTKWskrxtkR4M5AZR4JsYcJRTau/bG9SarUJKjJnF3nr1gqt+VeJw8EGR +ZPj06vzVpw8VV7NQhyWM12TdDVayK8NkQQXFTE/4vdB+M/8fvHwzzbqt GI16/5ABOtICQKVP65cDwLm7HqkRohKVKi3HW4JIo9wJMxSPiq2fi9pDF zoCFry5wTfUaLy1mcRM7sKwZICxy9YBRUcODdkumSBNulKxpAN7JvkF7/ ni23hpofi4D6EJDMIm8Uv9kaknjyMVwxFicbrEMyXoDtcen2mkKtDfDD3 w==; X-CSE-ConnectionGUID: ocxmXy4oT5mOEqyJeAASpw== X-CSE-MsgGUID: RkbBMY7QSlGUiB93EnnRoQ== X-IronPort-AV: E=McAfee;i="6800,10657,11775"; a="78789423" X-IronPort-AV: E=Sophos;i="6.23,215,1770624000"; d="scan'208";a="78789423" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa108.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 May 2026 01:57:32 -0700 X-CSE-ConnectionGUID: /bmu3p2XQp2+uo/+vqVLPA== X-CSE-MsgGUID: XB/y71JiRH2MlCGRyE4CBw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,215,1770624000"; d="scan'208";a="232814938" Received: from hrotuna-mobl2.ger.corp.intel.com (HELO localhost) ([10.245.245.78]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 May 2026 01:57:29 -0700 Date: Mon, 4 May 2026 11:57:27 +0300 From: Andy Shevchenko To: Michael Bommarito Cc: Mika Westerberg , linux-usb@vger.kernel.org, Andreas Noever , Yehezkel Bernat , Michael Jamet , Greg Kroah-Hartman , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH v3 1/4] thunderbolt: property: reject u32 wrap in tb_property_entry_valid() Message-ID: References: <20260415123221.225149-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Organization: Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs, Bertel Jungin Aukio 5, 02600 Espoo On Sun, May 03, 2026 at 10:15:05AM -0400, Michael Bommarito wrote: > entry->value is u32 and entry->length is u16; the sum is performed in > u32 and wraps. A malicious XDomain peer can pick > value = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0 > and passes the > block_len check. tb_property_parse() then passes > entry->value to parse_dwdata() as a dword offset into the property > block, reading attacker-directed memory far past the allocation. > > For TEXT-typed entries with the "deviceid" or "vendorid" keys this > lands in xd->device_name / xd->vendor_name and is readable back via > the per-XDomain device_name / vendor_name sysfs attributes; the leak > is NUL-bounded (kstrdup() stops at the first zero byte) and > untargeted (the attacker picks a delta, not an absolute address). > DATA-typed entries are parsed into property->value.data but not > generically surfaced to userspace. > > Use check_add_overflow() so a wrapped sum is rejected. ... > + if (check_add_overflow(entry->value, (u32)entry->length, &end) || Why is casting needed? > + end > block_len) > return false; -- With Best Regards, Andy Shevchenko