From: Michael Bommarito Date: Mon, 25 May 2026 09:28:26 +0000 (-0400) Subject: thunderbolt: Bound root directory content to block size X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=65423079c7420e3dbf9a7aa345c243a3f5752e5d;p=thirdparty%2Fkernel%2Flinux.git thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing content_offset and content_len to reject directories whose content extends past the block. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Mika Westerberg --- diff --git a/drivers/thunderbolt/property.c b/drivers/thunderbolt/property.c index 5cbc1c4f159c..59beab43f90a 100644 --- a/drivers/thunderbolt/property.c +++ b/drivers/thunderbolt/property.c @@ -187,6 +187,10 @@ static struct tb_property_dir *__tb_property_parse_dir(const u32 *block, if (is_root) { content_offset = dir_offset + 2; content_len = dir_len; + if (content_offset + content_len > block_len) { + tb_property_free_dir(dir); + return NULL; + } } else { if (dir_len < 4) { tb_property_free_dir(dir);