Re: [PATCH] thunderbolt: Reject oversized XDomain properties responses

[Mika Westerberg]

Hi,

On Wed, Sep 09, 2026 at 10:07:37AM +0900, Daehyeon Ko wrote:
> tb_xdp_properties_request() allocates room for 45 data dwords in its
> 252-byte response buffer.  The XDomain length field is six bits wide,
> however, and a malicious peer can set it to 63.  After the fixed response
> fields are subtracted, the driver treats this as 48 data dwords.
> 
> Commit 322e93448d90 ("thunderbolt: Clamp XDomain response data copy to
> allocation size") only bounds the copy against data_len.  If data_len is
> at least 48, memcpy() reads 192 bytes from the 180-byte res->data array,
> causing a 12-byte heap out-of-bounds read.  Commit 4db2bd2ed478
> ("thunderbolt: Limit XDomain response copy to actual frame size") limits
> the earlier copy but does not constrain this header-derived length.
> 
> Reject response data lengths that exceed the allocated source buffer
> before copying them into the assembled property block.
> 
> Fixes: d1ff70241a27 ("thunderbolt: Add support for XDomain discovery protocol")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@xxxxxxxxx>

Applied to thunderbolt.git/fixes, thanks!

BTW, there is similar for res->data_length == 0 below, maybe you can look
at that too?