[PATCH v3 2/2] thunderbolt: validate USB4 product descriptor entry size

[Pengpeng Hou]

The USB4 product descriptor parser casts a generic DROM entry to
struct tb_drom_entry_desc and reads its vendor and product identifiers
without requiring the entry to contain that structure.

A descriptor whose declared length covers only the generic entry header
therefore makes those field reads cross the entry boundary. Require the
entry to contain the descriptor structure before accessing it.

Fixes: b04079837b20 ("thunderbolt: Add initial support for USB4")
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/thunderbolt/eeprom.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 52d654048f07..6b83232b6bf4 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -348,6 +348,11 @@ static int tb_drom_parse_entry_generic(struct tb_switch *sw,
 		const struct tb_drom_entry_desc *desc =
 			(const struct tb_drom_entry_desc *)entry;
 
+		if (header->len < sizeof(*desc)) {
+			tb_sw_warn(sw, "USB4 product descriptor entry is too short\n");
+			return -EIO;
+		}
+
 		if (!sw->vendor && !sw->device) {
 			sw->vendor = desc->idVendor;
 			sw->device = desc->idProduct;
-- 
2.50.1 (Apple Git-155)