Commit 19813551701d ("thunderbolt: xdomain: Avoid potential stack OOB read") turned struct tb_xdp_properties_changed_response into a union of struct tb_xdp_error_response and struct tb_xdp_header, so that tb_xdp_handle_error() can safely read the error field of a received response. tb_xdp_properties_changed_response() still sends sizeof(res), so since that commit the response Linux sends is 36 bytes instead of 32: it carries the zeroed error field, and its XDomain length field says 6 dwords instead of 5. The other responses changed by that commit are not affected, because their non-error members are already larger than struct tb_xdp_error_response. macOS sends this response as the header only. macOS 27.2 (26B123) keeps re-sending PROPERTIES_CHANGED_REQUEST when it gets the longer response: after link-up it repeats the request every 1.5 s, ten times, and then resets the link, about 15 seconds after it came up. thunderbolt-net logs in and passes traffic before the reset. The same host stayed connected to the same Mac for about 23 hours while the Mac ran macOS 27.0.1, so the change in behavior came with macOS 27.2. Send only the header again, as before that commit. The union stays, so a received response still has room for the error field. Linux requesters accept the shorter response: tb_xdomain_match() requires only frame.size >= response_size / 4, and tb_xdp_handle_error() reads the error field only when the type is ERROR_RESPONSE. Tested on an ASMedia ASM4242 USB4 host running an Ubuntu 7.0.0-38 kernel, connected to a Mac17,6 running macOS 27.2. With this change macOS stops re-sending after the first answers, and tracing shows an 8-dword response with length 5, the same as the response macOS sends. The link has stayed up for over 1.5 hours, about 80 minutes of which carried a multi-gigabyte transfer every few minutes. Not tested: a Linux peer, the error response path, and macOS releases other than 27.2. The analysis, the fix and the tests were done with an AI coding assistant. Fixes: 19813551701d ("thunderbolt: xdomain: Avoid potential stack OOB read") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5-5 Signed-off-by: JaeGwon Go --- drivers/thunderbolt/xdomain.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c index b187a60..563a8b6 100644 --- a/drivers/thunderbolt/xdomain.c +++ b/drivers/thunderbolt/xdomain.c @@ -509,8 +509,8 @@ tb_xdp_properties_changed_response(struct tb_ctl *ctl, u64 route, u8 sequence) memset(&res, 0, sizeof(res)); tb_xdp_fill_header(&res.hdr, route, sequence, - PROPERTIES_CHANGED_RESPONSE, sizeof(res)); - return __tb_xdomain_response(ctl, &res, sizeof(res), + PROPERTIES_CHANGED_RESPONSE, sizeof(res.hdr)); + return __tb_xdomain_response(ctl, &res.hdr, sizeof(res.hdr), TB_CFG_PKG_XDOMAIN_RESP); } -- 2.54.0 (Apple Git-157)