Re: [PATCH v2 1/4] thunderbolt: property: reject u32 wrap in tb_property_entry_valid()
From: Michael Bommarito
Date: Sat May 02 2026 - 13:55:45 EST
On Mon, Apr 27, 2026 at 1:35 AM Mika Westerberg
<mika.westerberg@xxxxxxxxxxxxxxx> wrote:
> I was about to apply these but noticed few stylistic issues so can you fix
> those and send v3?
>
> On Wed, Apr 15, 2026 at 08:32:17AM -0400, Michael Bommarito wrote:
> > entry->value is u32 and entry->length is u16; the sum is performed in
> > u32 and wraps. A malicious XDomain peer can pick
> > value = 0xFFFFFF00, length = 0x100 so the sum 0x100000000 wraps to 0
>
> It's 0xffffff00 (e.g lower case).
>
> Ditto everywhere.
Sure, sorry for the slow turnaround. Coming shortly.
Thanks,
Mike Bommarito