Re: [PATCH] thunderbolt: Send header-only XDomain properties changed response

[Mika Westerberg]

Hi,

On Thu, Oct 29, 2026 at 05:18:34PM +0900, JaeGwon Go wrote:
> Commit 19813551701d ("thunderbolt: xdomain: Avoid potential stack OOB
> read") turned struct tb_xdp_properties_changed_response into a union of
> struct tb_xdp_error_response and struct tb_xdp_header, so that
> tb_xdp_handle_error() can safely read the error field of a received
> response. tb_xdp_properties_changed_response() still sends sizeof(res),
> so since that commit the response Linux sends is 36 bytes instead of
> 32: it carries the zeroed error field, and its XDomain length field
> says 6 dwords instead of 5. The other responses changed by that commit
> are not affected, because their non-error members are already larger
> than struct tb_xdp_error_response.
> 
> macOS sends this response as the header only. macOS 27.2 (26B123) keeps
> re-sending PROPERTIES_CHANGED_REQUEST when it gets the longer response:
> after link-up it repeats the request every 1.5 s, ten times, and then
> resets the link, about 15 seconds after it came up. thunderbolt-net
> logs in and passes traffic before the reset. The same host stayed
> connected to the same Mac for about 23 hours while the Mac ran macOS
> 27.0.1, so the change in behavior came with macOS 27.2.
> 
> Send only the header again, as before that commit. The union stays, so
> a received response still has room for the error field. Linux
> requesters accept the shorter response: tb_xdomain_match() requires
> only frame.size >= response_size / 4, and tb_xdp_handle_error() reads
> the error field only when the type is ERROR_RESPONSE.
> 
> Tested on an ASMedia ASM4242 USB4 host running an Ubuntu 7.0.0-38
> kernel, connected to a Mac17,6 running macOS 27.2. With this change
> macOS stops re-sending after the first answers, and tracing shows an
> 8-dword response with length 5, the same as the response macOS sends.
> The link has stayed up for over 1.5 hours, about 80 minutes of which
> carried a multi-gigabyte transfer every few minutes. Not tested: a
> Linux peer, the error response path, and macOS releases other than
> 27.2.
> 
> The analysis, the fix and the tests were done with an AI coding
> assistant.
> 
> Fixes: 19813551701d ("thunderbolt: xdomain: Avoid potential stack OOB read")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: JaeGwon Go <ceo@xxxxxxxxxxxxx>

Applied to thunderbolt.git/fixes, thanks!