Re: [PATCH 1/2] thunderbolt: Validate DP bandwidth notification port

[Mika Westerberg]

Hi,

On Wed, Sep 09, 2026 at 12:50:39PM +0900, Daehyeon Ko wrote:
> The port number in a DP bandwidth notification is six bits wide and
> comes from the router. A router whose maximum port number is smaller can
> therefore make tb_handle_dp_bandwidth_request() index beyond the
> max_port_number + 1 entries allocated for sw->ports. The first
> tb_port_is_dpin() check then reads the out-of-bounds object.
> 
> Reject notifications that refer to a non-existent adapter before
> dereferencing the port.
> 
> Fixes: 6ce3563520be ("thunderbolt: Add support for DisplayPort bandwidth allocation mode")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@xxxxxxxxx>
> ---
>  drivers/thunderbolt/tb.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
> index 47753a5c0f2eb..8551dafe98c8e 100644
> --- a/drivers/thunderbolt/tb.c
> +++ b/drivers/thunderbolt/tb.c
> @@ -2756,6 +2756,11 @@ static void tb_handle_dp_bandwidth_request(struct work_struct *work)
>  		goto unlock;
>  	}
>  
> +	if (ev->port > sw->config.max_port_number) {
> +		tb_sw_warn(sw, "bandwidth request from non-existent port %u\n",
> +			   ev->port);
> +		goto put_sw;

For this can you make a helper function tb_switch_port(sw, ev->port) that
issues a warning and then replace the direct access sw->ports[] with that?

> +	}
>  	in = &sw->ports[ev->port];
>  	if (!tb_port_is_dpin(in)) {
>  		tb_port_warn(in, "bandwidth request to non-DP IN adapter\n");
> -- 
> 2.55.0