Messages in this thread | | | From | Etienne Carriere <> | Date | Tue, 31 May 2022 16:59:35 +0200 | Subject | Re: [PATCH] firmware: arm_scmi: Relax BASE protocol sanity checks on protocol list |
| |
Hello Cristian,
On Mon, 23 May 2022 at 19:17, Cristian Marussi <cristian.marussi@arm.com> wrote: > > Even though malformed replies from firmware must be treated carefully to > avoid memory corruption Kernel side, some out-of-spec SCMI replies can > be tolerated to avoid breaking existing deployed system, as long as they > won't cause memory issues. > > Reported-by: Nicolas Frattaroli <frattaroli.nicolas@gmail.com> > Cc: Etienne Carriere <etienne.carriere@linaro.org> > Cc: Sudeep Holla <sudeep.holla@arm.com> > Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Best regards, etienne
> --- > drivers/firmware/arm_scmi/base.c | 16 +++++++++++----- > 1 file changed, 11 insertions(+), 5 deletions(-) > > diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c > index 20fba7370f4e..d0ac96da1ddf 100644 > --- a/drivers/firmware/arm_scmi/base.c > +++ b/drivers/firmware/arm_scmi/base.c > @@ -221,11 +221,17 @@ scmi_base_implementation_list_get(const struct scmi_protocol_handle *ph, > calc_list_sz = (1 + (loop_num_ret - 1) / sizeof(u32)) * > sizeof(u32); > if (calc_list_sz != real_list_sz) { > - dev_err(dev, > - "Malformed reply - real_sz:%zd calc_sz:%u\n", > - real_list_sz, calc_list_sz); > - ret = -EPROTO; > - break; > + dev_warn(dev, > + "Malformed reply - real_sz:%zd calc_sz:%u (loop_num_ret:%d)\n", > + real_list_sz, calc_list_sz, loop_num_ret); > + /* > + * Bail out if the expected list size is bigger than the > + * total payload size of the received reply. > + */ > + if (calc_list_sz > real_list_sz) { > + ret = -EPROTO; > + break; > + } > } > > for (loop = 0; loop < loop_num_ret; loop++) > -- > 2.36.1 >
| |