Re: [PATCH v3 0/2] thunderbolt: validate DROM entry extents

[Mika Westerberg]

Hi,

On Thu, Aug 13, 2026 at 11:22:06PM +0800, Pengpeng Hou wrote:
> The generic DROM walker can read a two-byte entry header from a one-byte
> tail and accepts an entry whose declared length is shorter than that
> header.  Separately, the USB4 product descriptor parser reads a complete
> struct tb_drom_entry_desc without requiring that structure to be present.
> 
> Split those contracts into two patches.  The descriptor check now uses
> sizeof(*desc), as requested by Mika Westerberg, instead of spelling out
> the fields manually.
> 
> Changes since v2:
> https://lore.kernel.org/all/20260731141700.3-thunderbolt-v2-pengpeng@xxxxxxxxxxx/
> - split the generic entry and USB4 descriptor checks
> - validate the USB4 entry with sizeof(*desc)
> - rebase and re-review against the current tree
> 
> The series was reviewed statically. I did not test it with malformed
> device DROM data.
> 
> Pengpeng Hou (2):
>   thunderbolt: require complete DROM entry headers
>   thunderbolt: validate USB4 product descriptor entry size

I dropped the Fixes tag, I think these are more like improvements. In
addition I changed the first patch to use const where possible. Please
check that it makes sense for you.

Both applied to thunderbolt.git/next, thanks!