[PATCH] thunderbolt: Reject oversized XDomain properties responses

[PATCH] thunderbolt: Reject oversized XDomain properties responses

[Daehyeon Ko]

tb_xdp_properties_request() allocates room for 45 data dwords in its
252-byte response buffer.  The XDomain length field is six bits wide,
however, and a malicious peer can set it to 63.  After the fixed response
fields are subtracted, the driver treats this as 48 data dwords.

Commit 322e93448d90 ("thunderbolt: Clamp XDomain response data copy to
allocation size") only bounds the copy against data_len.  If data_len is
at least 48, memcpy() reads 192 bytes from the 180-byte res->data array,
causing a 12-byte heap out-of-bounds read.  Commit 4db2bd2ed478
("thunderbolt: Limit XDomain response copy to actual frame size") limits
the earlier copy but does not constrain this header-derived length.

Reject response data lengths that exceed the allocated source buffer
before copying them into the assembled property block.

Fixes: d1ff70241a27 ("thunderbolt: Add support for XDomain discovery protocol")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---
A private synthetic KUnit reproducer is available to the individual
maintainers on request. It observed adjacent memory copied on 3/3 fresh
boots; the fixed control passed on 3/3 fresh boots. Physical Thunderbolt
peer injection was not available and was not tested.

Tested on current mainline 893e11787f78:
- allmodconfig W=1 drivers/thunderbolt/xdomain.o build
- strict checkpatch
- clean git am with matching result tree and patch-id
- clean apply to current linux-next, Thunderbolt next, v7.2,
  v6.12.105, and hardened-v1-7.2-rc5

 drivers/thunderbolt/xdomain.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
index c179bd751fe42..0e1e6d90a977f 100644
--- a/drivers/thunderbolt/xdomain.c
+++ b/drivers/thunderbolt/xdomain.c
@@ -377,6 +377,10 @@ static int tb_xdp_properties_request(struct tb_ctl *ctl, u64 route,
 
 		len += sizeof(res->hdr.xd_hdr) / 4;
 		len -= sizeof(*res) / 4;
+		if (len > TB_XDP_PROPERTIES_MAX_DATA_LENGTH) {
+			ret = -EINVAL;
+			goto err;
+		}
 
 		if (res->offset != req.offset) {
 			ret = -EINVAL;

base-commit: 893e11787f78e43b534e252249ac3fff4d1333f8