[lvc-project] [PATCH] thunderbolt: verify PCI resource type and size in nhi_probe()

[Mika Westerberg]

On Fri, Aug 07, 2026 at 03:36:09PM +0300, Dmitry Antipov wrote:
> On 8/7/26 3:01 PM, Mika Westerberg wrote:
> 
> > Okay through driver_override, thanks. It also says:
> > 
> >    Buses opt into this mechanism by setting the driver_override flag in their
> >    struct bus_type.
> > 
> > But that's not done in struct tb_bus_type.
> > 
> > So there should be no such attribute available even.
> 
> Hm. Syzbot's reproducer definitely uses /sys/bus/pci/devices/0000:00:02.0/driver_override
> and /sys/bus/pci/drivers/thunderbolt/bind to make a trick. IIUC the kernel starts to probe
> NHI just like any regular PCI device (so driver_override is expected to work), and
> tb_bus_type enters the game during the probe itself during nhi_probe() -> nhi_select_cm()
> -> tb_probe() -> tb_domain_alloc().

Well say if it finds a random device that has BAR that is of correct type
and size then we are in the same situation again (and I think this applies
to many drivers -- that's why we have the ID/class or similar matching
there to make sure these bind to expected hardware).