[PATCH 2/2] thunderbolt: Validate output ports while discovering paths

[Daehyeon Ko]

Path discovery reads the six-bit output port number from router HOPS
configuration space and uses it to index sw->ports at three sites. A
router can return a number larger than max_port_number and make the
connection manager read an out-of-bounds tb_port, retain the invalid
pointer in a path, or pass its embedded HopID allocator to IDA.

Resolve each output port through a bounded helper. In the construction
pass, validate the output port before allocating the input HopID so a
rejected entry needs no additional unwind.

Fixes: 0414bec5f39a ("thunderbolt: Discover preboot PCIe paths the boot firmware established")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@xxxxxxxxx>
---
 drivers/thunderbolt/path.c | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/drivers/thunderbolt/path.c b/drivers/thunderbolt/path.c
index b2c322e76b8ad..ea72153690dd3 100644
--- a/drivers/thunderbolt/path.c
+++ b/drivers/thunderbolt/path.c
@@ -31,6 +31,17 @@ static void tb_dump_hop(const struct tb_path_hop *hop, const struct tb_regs_hop
 		    regs->unknown1, regs->unknown2, regs->unknown3);
 }
 
+static struct tb_port *tb_path_hop_out_port(struct tb_switch *sw,
+					    const struct tb_regs_hop *hop)
+{
+	if (hop->out_port > sw->config.max_port_number) {
+		tb_sw_warn(sw, "hop refers to non-existent port %u\n",
+			   hop->out_port);
+		return NULL;
+	}
+	return &sw->ports[hop->out_port];
+}
+
 static struct tb_port *tb_path_find_dst_port(struct tb_port *src, int src_hopid,
 					     int dst_hopid)
 {
@@ -54,7 +65,9 @@ static struct tb_port *tb_path_find_dst_port(struct tb_port *src, int src_hopid,
 		if (!hop.enable)
 			return NULL;
 
-		out_port = &sw->ports[hop.out_port];
+		out_port = tb_path_hop_out_port(sw, &hop);
+		if (!out_port)
+			return NULL;
 		hopid = hop.next_hop;
 		port = out_port->remote;
 	}
@@ -141,7 +154,9 @@ struct tb_path *tb_path_discover(struct tb_port *src, int src_hopid,
 		if (!hop.enable)
 			break;
 
-		out_port = &sw->ports[hop.out_port];
+		out_port = tb_path_hop_out_port(sw, &hop);
+		if (!out_port)
+			return NULL;
 		if (last)
 			*last = out_port;
 
@@ -178,12 +193,14 @@ struct tb_path *tb_path_discover(struct tb_port *src, int src_hopid,
 			goto err;
 		}
 
-		if (alloc_hopid && tb_port_alloc_in_hopid(p, h, h) < 0)
+		out_port = tb_path_hop_out_port(sw, &hop);
+		if (!out_port)
 			goto err;
-
-		out_port = &sw->ports[hop.out_port];
 		next_hop = hop.next_hop;
 
+		if (alloc_hopid && tb_port_alloc_in_hopid(p, h, h) < 0)
+			goto err;
+
 		if (alloc_hopid &&
 		    tb_port_alloc_out_hopid(out_port, next_hop, next_hop) < 0) {
 			tb_port_release_in_hopid(p, h);
-- 
2.55.0