Re: [PATCH v15 01/35] firmware: arm_scmi: Harden iterators state parsing

[Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>]

On Mon,  9 Nov 2026 09:11:47 +0000
Cristian Marussi <cristian.marussi@arm.com> wrote:

> Add checks in the core multi-part iterators support to detect generally
> malformed and incosistent multi-part replies.

Spell check patch descriptions.  inconsistent.

Otherwise seems fine but I'm too lazy to check all existing protocols for
that minimum size!

> 
> Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
> ---
>  drivers/firmware/arm_scmi/driver.c    | 10 ++++++++++
>  drivers/firmware/arm_scmi/protocols.h |  6 ++++++
>  2 files changed, 16 insertions(+)
> 
> diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
> index 05092301db29..55d9cc487916 100644
> --- a/drivers/firmware/arm_scmi/driver.c
> +++ b/drivers/firmware/arm_scmi/driver.c
> @@ -1873,11 +1873,21 @@ static int __scmi_iterator_run(void *iter, unsigned int *start, unsigned int *en
>  		if (ret)
>  			return ret;
>  
> +		if (i->t->rx.len < SCMI_MULTIPART_REPLY_MIN_SZ) {
> +			dev_err(ph->dev, "Invalid multi-part reply.\n");
> +			return -EINVAL;
> +		}
> +
>  		st->rx_len = i->t->rx.len;
>  		ret = iops->update_state(st, i->resp, i->priv);
>  		if (ret)
>  			return ret;
>  
> +		if (!st->num_returned && st->num_remaining) {
> +			dev_err(ph->dev, "Inconsistent multi-part reply.\n");
> +			return -EINVAL;
> +		}
> +
>  		if (st->num_returned > st->max_resources - st->desc_index) {
>  			dev_err(ph->dev,
>  				"No. of resources can't exceed %d\n",
> diff --git a/drivers/firmware/arm_scmi/protocols.h b/drivers/firmware/arm_scmi/protocols.h
> index 8583159059e6..b295006ef1fd 100644
> --- a/drivers/firmware/arm_scmi/protocols.h
> +++ b/drivers/firmware/arm_scmi/protocols.h
> @@ -33,6 +33,12 @@
>  
>  #define MSG_SUPPORTS_FASTCHANNEL(x)	((x) & BIT(0))
>  
> +/*
> + * Common minimum size currently required by all the existing standard and
> + * vendor protocols.
> + */
> +#define SCMI_MULTIPART_REPLY_MIN_SZ	(sizeof(u32))
> +
>  enum scmi_common_cmd {
>  	PROTOCOL_VERSION = 0x0,
>  	PROTOCOL_ATTRIBUTES = 0x1,