diff options
| author | Michael Bommarito <michael.bommarito@gmail.com> | 2026-05-25 12:28:27 +0300 |
|---|---|---|
| committer | Mika Westerberg <mika.westerberg@linux.intel.com> | 2026-05-26 16:18:25 +0300 |
| commit | 322e93448d908434ae5545660fcbe8f5a7a8e141 (patch) | |
| tree | 5f5db5d7af4c125f9a89e60e92e688f747c1a8ea /tools/lib/python/kdoc/python_version.py | |
| parent | 65423079c7420e3dbf9a7aa345c243a3f5752e5d (diff) | |
| download | linux-322e93448d908434ae5545660fcbe8f5a7a8e141.tar.xz | |
thunderbolt: Clamp XDomain response data copy to allocation size
tb_xdp_properties_request() derives the per-packet copy length from
the response header without checking that it fits in the previously
allocated data buffer. A malicious peer can set its length field
larger than the declared data_length, causing memcpy to write past
the kcalloc allocation.
Clamp the per-packet copy length so that the cumulative offset
never exceeds data_len.
Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions