From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id EE6FBC43458 for ; Fri, 3 Jul 2026 20:25:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References :Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=FD/NU7GMm4Zv7S8veQFrmWmOgLAG1xEI2EsNyDH4suY=; b=MBPrMFUm/GqDhkS4VMhzE+qn8T 6XRv169PCbM8gB5srICcFn2KFDWa96qXRWJSiAWensL4uMcMcWhrDb0WG0ihwgVUzDt4fsQEC6SyZ k5qc/EEEI5lAsFMMICttZSaNP6NanIvYWw8PsfDrwlHL5idmvprJqGuB0kmJ2Wv+KAm/2SgxksAUu 2J4EeRDdKIZ4nbGeNJrPAW+ROwwmXaiaQ5DYb6TIMrioD8qErb+M22ALPYJjfcelheqBDtjL3SEI0 zFJ+TcjO+VJBlY+52meYQoEE5KF1sFaQQEoJynqOM4jpUMDYmrFUrU+mEZ721fJk5p6TZcdfhvGj1 c29ErWqQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wfkSF-00000007qWA-2oRJ; Fri, 03 Jul 2026 20:25:43 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wfkSC-00000007qRN-1AJS for linux-arm-kernel@lists.infradead.org; Fri, 03 Jul 2026 20:25:40 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id B6FED60051; Fri, 3 Jul 2026 20:25:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC9371F000E9; Fri, 3 Jul 2026 20:25:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783110339; bh=FD/NU7GMm4Zv7S8veQFrmWmOgLAG1xEI2EsNyDH4suY=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Q2TZD7Vh0c93x3ZZ+vHsgY90YDnYmo9sRYsBSxwRkemcEnX5hVadXK+nmiPSt14wm jM1W3QLY8779wVvNCFEzcrbLtyO5SQBFBmILMyDXBm5eaWyGhS5VwyraHIpBtAmTFg Pyst9NQP7zpR8lNbdYcahJxVh0A13da44uHJ/T+BogLBOETbR1IJQ/pLL77G4Sq6OU PwYYIHTV+R/msrgO8EWfvvMAbkL0R1GVUGsZvCrXSG9MhZDzFUr3zAKNpKFjIINIoH +8MVgJzJny2PtP/Nl1aOS40uEeiOnwMyBqaPIXZy1FGQXCkQi4ukNtfHlr3eUWNPVx xssTHtMKA//sw== From: Sudeep Holla Date: Fri, 03 Jul 2026 21:22:48 +0100 Subject: [PATCH v3 12/17] firmware: arm_scmi: Reject out of range DT protocol IDs MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260703-scmi_core_fixes-v3-12-5bae9766abfc@kernel.org> References: <20260703-scmi_core_fixes-v3-0-5bae9766abfc@kernel.org> In-Reply-To: <20260703-scmi_core_fixes-v3-0-5bae9766abfc@kernel.org> To: arm-scmi@vger.kernel.org, linux-arm-kernel@lists.infradead.org Cc: Cristian Marussi X-Mailer: b4 0.15.2 X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org SCMI protocol IDs carried in message headers are limited by MSG_PROTOCOL_ID_MASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then kept processing the invalid value. That lets a malformed 32-bit DT reg value reach helpers which take a u8 protocol ID, where it can be truncated and/or treated as a different protocol. For channel setup, two different out-of-range values can also be used as distinct IDR keys while aliasing the generated SCMI protocol identity. Skip DT protocol nodes whose reg value does not fit the SCMI protocol ID field before setting up channels or creating protocol devices. Fixes: 05a2801d8b90 ("firmware: arm_scmi: Use dedicated devices to initialize channels") Reported-by: Sashiko Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/driver.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c index ae4b7128276b..f515b192c1bd 100644 --- a/drivers/firmware/arm_scmi/driver.c +++ b/drivers/firmware/arm_scmi/driver.c @@ -2874,9 +2874,11 @@ static int scmi_channels_setup(struct scmi_info *info) if (of_property_read_u32(child, "reg", &prot_id)) continue; - if (!FIELD_FIT(MSG_PROTOCOL_ID_MASK, prot_id)) + if (!FIELD_FIT(MSG_PROTOCOL_ID_MASK, prot_id)) { dev_err(info->dev, "Out of range protocol %d\n", prot_id); + continue; + } ret = scmi_txrx_setup(info, child, prot_id); if (ret) @@ -3341,8 +3343,10 @@ static int scmi_probe(struct platform_device *pdev) if (of_property_read_u32(child, "reg", &prot_id)) continue; - if (!FIELD_FIT(MSG_PROTOCOL_ID_MASK, prot_id)) + if (!FIELD_FIT(MSG_PROTOCOL_ID_MASK, prot_id)) { dev_err(dev, "Out of range protocol %d\n", prot_id); + continue; + } if (!scmi_is_protocol_implemented(handle, prot_id)) { dev_err(dev, "SCMI protocol %d not implemented\n", -- 2.43.0