github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

thunderbolt: Bound the DROM dual link port number before indexing sw->ports

Browse Source 
tb_drom_parse_entry_port() validates the device-supplied header->index
against sw->config.max_port_number before indexing sw->ports[], but the
sibling field entry->dual_link_port_nr -- a 6-bit value also read from
the DROM -- indexes the same array with no such check. A malicious or
malformed Thunderbolt device can set dual_link_port_nr beyond the
allocated sw->ports[] (max_port_number + 1 entries), producing an
out-of-bounds tb_port pointer that is stored and later dereferenced.

Reject a port entry whose dual_link_port_nr exceeds max_port_number,
the same bound already applied to header->index.

Fixes: cd22e73bdf ("thunderbolt: Read port configuration from eeprom.")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
This commit is contained in:
Bryam Vargas 2026-06-25 06:54:09 -05:00 committed by Mika Westerberg
parent d2ee4d47aa
commit d6764992f1
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/thunderbolt/eeprom.c
View File

@ -394,9 +394,16 @@ static int tb_drom_parse_entry_port(struct tb_switch *sw,
return -EIO;
}
port->link_nr = entry->link_nr;
if (entry->has_dual_link_port)
if (entry->has_dual_link_port) {
if (entry->dual_link_port_nr > sw->config.max_port_number) {
tb_sw_warn(sw,
"port entry has invalid dual link port number %u\n",
entry->dual_link_port_nr);
return -EIO;
}
port->dual_link_port =
&port->sw->ports[entry->dual_link_port_nr];
}
}
return 0;
}