[PATCH v2] thunderbolt: Validate DP bandwidth notification port

[PATCH v2] thunderbolt: Validate DP bandwidth notification port

[Daehyeon Ko]

The port number in a DP bandwidth notification is six bits wide and
comes from the router. A router whose maximum port number is smaller can
therefore make tb_handle_dp_bandwidth_request() index beyond the
max_port_number + 1 entries allocated for sw->ports. The first
tb_port_is_dpin() check then reads the out-of-bounds object.

Add a common helper that warns and rejects out-of-range port numbers,
and use it before dereferencing the notification port.

Fixes: 6ce3563520be ("thunderbolt: Add support for DisplayPort bandwidth allocation mode")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---
Changes in v2:
- Add tb_switch_port() and use it for both tb_port_at() and the DP
  bandwidth notification lookup, as requested by Mika.
- Submit the DP bandwidth fix alone; the path-discovery change is not
  included.

 drivers/thunderbolt/tb.c |  4 +++-
 drivers/thunderbolt/tb.h | 11 ++++++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index 47753a5c0f2e..4854735514af 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -2756,7 +2756,9 @@ static void tb_handle_dp_bandwidth_request(struct work_struct *work)
 		goto unlock;
 	}
 
-	in = &sw->ports[ev->port];
+	in = tb_switch_port(sw, ev->port);
+	if (!in)
+		goto put_sw;
 	if (!tb_port_is_dpin(in)) {
 		tb_port_warn(in, "bandwidth request to non-DP IN adapter\n");
 		goto put_sw;
diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h
index 4373336d9425..48dc57250e45 100644
--- a/drivers/thunderbolt/tb.h
+++ b/drivers/thunderbolt/tb.h
@@ -585,14 +585,19 @@ static inline u64 tb_route(const struct tb_switch *sw)
 	return ((u64) sw->config.route_hi) << 32 | sw->config.route_lo;
 }
 
+static inline struct tb_port *tb_switch_port(struct tb_switch *sw, u8 port)
+{
+	if (WARN_ON(port > sw->config.max_port_number))
+		return NULL;
+	return &sw->ports[port];
+}
+
 static inline struct tb_port *tb_port_at(u64 route, struct tb_switch *sw)
 {
 	u8 port;
 
 	port = route >> (sw->config.depth * 8);
-	if (WARN_ON(port > sw->config.max_port_number))
-		return NULL;
-	return &sw->ports[port];
+	return tb_switch_port(sw, port);
 }
 
 static inline const char *tb_width_name(enum tb_link_width width)

base-commit: 50d05c7c76c96b90462f24debacca971d2e86713
-- 
2.55.0

Re: [PATCH v2] thunderbolt: Validate DP bandwidth notification port

[Mika Westerberg]

Hi,

On Thu, Sep 10, 2026 at 11:11:58PM +0900, Daehyeon Ko wrote:
> The port number in a DP bandwidth notification is six bits wide and
> comes from the router. A router whose maximum port number is smaller can
> therefore make tb_handle_dp_bandwidth_request() index beyond the
> max_port_number + 1 entries allocated for sw->ports. The first
> tb_port_is_dpin() check then reads the out-of-bounds object.
> 
> Add a common helper that warns and rejects out-of-range port numbers,
> and use it before dereferencing the notification port.
> 
> Fixes: 6ce3563520be ("thunderbolt: Add support for DisplayPort bandwidth allocation mode")
> Cc: stable@vger.kernel.org

Instead of fixes I think this one should be going in as improvement. At the
moment there are no known device routers with DP IN so it's only hosts and
we trust them.

> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
> ---
> Changes in v2:
> - Add tb_switch_port() and use it for both tb_port_at() and the DP
>   bandwidth notification lookup, as requested by Mika.
> - Submit the DP bandwidth fix alone; the path-discovery change is not
>   included.
> 
>  drivers/thunderbolt/tb.c |  4 +++-
>  drivers/thunderbolt/tb.h | 11 ++++++++---
>  2 files changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
> index 47753a5c0f2e..4854735514af 100644
> --- a/drivers/thunderbolt/tb.c
> +++ b/drivers/thunderbolt/tb.c
> @@ -2756,7 +2756,9 @@ static void tb_handle_dp_bandwidth_request(struct work_struct *work)
>  		goto unlock;
>  	}
>  
> -	in = &sw->ports[ev->port];
> +	in = tb_switch_port(sw, ev->port);
> +	if (!in)
> +		goto put_sw;

Can you also replace the code in tb_handle_hotplug() with this?

>  	if (!tb_port_is_dpin(in)) {
>  		tb_port_warn(in, "bandwidth request to non-DP IN adapter\n");
>  		goto put_sw;
> diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h
> index 4373336d9425..48dc57250e45 100644
> --- a/drivers/thunderbolt/tb.h
> +++ b/drivers/thunderbolt/tb.h
> @@ -585,14 +585,19 @@ static inline u64 tb_route(const struct tb_switch *sw)
>  	return ((u64) sw->config.route_hi) << 32 | sw->config.route_lo;
>  }
>  
> +static inline struct tb_port *tb_switch_port(struct tb_switch *sw, u8 port)
> +{
> +	if (WARN_ON(port > sw->config.max_port_number))

Make this tb_sw_warn() instead.

> +		return NULL;
> +	return &sw->ports[port];
> +}
> +
>  static inline struct tb_port *tb_port_at(u64 route, struct tb_switch *sw)
>  {
>  	u8 port;
>  
>  	port = route >> (sw->config.depth * 8);
> -	if (WARN_ON(port > sw->config.max_port_number))
> -		return NULL;
> -	return &sw->ports[port];
> +	return tb_switch_port(sw, port);
>  }
>  
>  static inline const char *tb_width_name(enum tb_link_width width)
> 
> base-commit: 50d05c7c76c96b90462f24debacca971d2e86713
> -- 
> 2.55.0