Re: [PATCH] platform: arm64: qcom-hamoa-ec: reject incomplete responses

[Bryan O'Donoghue <bryan.odonoghue@linaro.org>]

On 28/07/2026 12:19, Linmao Li wrote:
> qcom_ec_read() accepts short positive transfers, while both callers
> unconditionally consume every field in their fixed-size response. A short
> transfer can therefore make them use trailing stack bytes that were not
> returned by the device.
> 
> The first response byte contains the number of payload bytes, excluding
> the byte count itself. A complete response of resp_len bytes must
> therefore report resp_len - 1 payload bytes. The existing check only
> rejects counts that do not fit in the response buffer and still accepts
> an incomplete payload.
> 
> Require both the SMBus transfer length and the EC-provided payload count
> to match the expected response size.
> 
> Fixes: 5c44f48e91de ("platform: arm64: Add driver for EC found on Qualcomm reference devices")
> Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
> ---
> The resp_len - 1 requirement is based solely on the response layouts
> documented in this driver. The EC specification and hardware were not
> available, so please confirm it for supported firmware revisions.
> 
> Compile-tested with CONFIG_EC_QCOM_HAMOA=m.
> 
>   drivers/platform/arm64/qcom-hamoa-ec.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/arm64/qcom-hamoa-ec.c b/drivers/platform/arm64/qcom-hamoa-ec.c
> index 5ca7308c6077..4d2ad042a7f8 100644
> --- a/drivers/platform/arm64/qcom-hamoa-ec.c
> +++ b/drivers/platform/arm64/qcom-hamoa-ec.c
> @@ -92,8 +92,10 @@ static int qcom_ec_read(struct qcom_ec *ec, u8 cmd, u8 resp_len, u8 *resp)
>   		return ret;
>   	else if (ret == 0 || ret == 0xff)
>   		return -EOPNOTSUPP;
> +	else if (ret != resp_len)
> +		return -EIO;
>   
> -	if (resp[0] >= resp_len)
> +	if (resp[0] != resp_len - 1)
>   		return -EINVAL;
>   
>   	return 0;
> 
> base-commit: c5e32e86ca02b003f86e095d379b38148999293d

The logic stacks-up, interesting to see if the hardware produces blue 
smoke though.

Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>