thunderbolt: Bound root directory content to block size

__tb_property_parse_dir() does not check that content_offset +
content_len fits within block_len for the root directory case.
When rootdir->length equals or exceeds block_len - 2, the entry
loop reads past the allocated property block.

Add a bounds check after computing content_offset and content_len
to reject directories whose content extends past the block.

Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>

diff --git a/drivers/thunderbolt/property.c b/drivers/thunderbolt/property.c
index 5cbc1c4f159c255a039e10824dfb5a73a9cdd636..59beab43f90a6a68c7c2b4d65a13ef1c45505efe 100644 (file)
--- a/drivers/thunderbolt/property.c
+++ b/drivers/thunderbolt/property.c
@@ -187,6 +187,10 @@ static struct tb_property_dir *__tb_property_parse_dir(const u32 *block,
        if (is_root) {
                content_offset = dir_offset + 2;
                content_len = dir_len;
+               if (content_offset + content_len > block_len) {
+                       tb_property_free_dir(dir);
+                       return NULL;
+               }
        } else {
                if (dir_len < 4) {
                        tb_property_free_dir(dir);