From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CDC214F4CEF; Thu, 17 Sep 2026 17:51:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789667484; cv=none; b=QfJh66EZC+E2iNM3SGaYLpOKlX3/GPmmItkEW/M4HmFt2KvDhwuhJsgtPxVjq+T9r1ZJQIJFNpFTtn/LIXTFno+3r4Ni4/TAESw19Nt84W3J5Kj9c4h/Ri7wJrlg5nDEy26qVL4Uh3Hb9mch3lbQW7JAqq72wzKqmh1JN9AiL2s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789667484; c=relaxed/simple; bh=1QRRKYhuSHnndmLOvM/1BSuq9xIVrApH4BgsQhAIK/U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=itc/FX+/X5DPKsWRE0DXgpyDqQzaTgVch+7qs8kpIsMFEEEFOy1ravmOo4ZZ5ScnGhlt1HsTpUxuEuSNiSiMs9BgrKVe/RW7RwL1ae35xywIItFV+X4jxD1swF2tYokQCBiXqSd4ttV5bkVc3Aqxr+lYBxvnFysBR9SIJvqefn8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QgrLWeVO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="QgrLWeVO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 25B4F1F000FF; Thu, 17 Sep 2026 17:51:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789667482; bh=rbC6UkoqdBOK57+C3i4mPS0pTwYXAITDAmAeVtDLD7E=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QgrLWeVOOFdvu5yrieNF7kw6IFMdSn067VGw/p6qItQUl0mdZq8/p5JLzJJ1vJTaA Ya3DTqGepzqQaYaqeFRBxKn1COEQo9EJlpEoyucYPSkbrPmN5CiKGM8vtt9LqjBpN5 kdmm1VzAFrc9QssIpyV9Mu08T9t+zTjimcLYCD0U= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Cristian Marussi , Sudeep Holla , Sasha Levin Subject: [PATCH 6.12 0108/1102] firmware: arm_scmi: Validate SENSOR_UPDATE payload size Date: Thu, 17 Sep 2026 16:00:51 +0100 Message-ID: <20260917151542.212901879@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260917151539.408551884@linuxfoundation.org> References: <20260917151539.408551884@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sudeep Holla [ Upstream commit 32bc5496b48174dbca1f187f710955ee4d9527a1 ] SENSOR_UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not verify that the received payload contains those entries before parsing them. Reject truncated update notifications before reading the variable array. Link: https://patch.msgid.link/20260517-scmi_fixes-v1-3-d86daec4defd@kernel.org Reviewed-by: Cristian Marussi Signed-off-by: Sudeep Holla Signed-off-by: Sasha Levin --- drivers/firmware/arm_scmi/sensors.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c index 1be0f89fc2c4b..99233742714c9 100644 --- a/drivers/firmware/arm_scmi/sensors.c +++ b/drivers/firmware/arm_scmi/sensors.c @@ -1074,12 +1074,15 @@ scmi_sensor_fill_custom_report(const struct scmi_protocol_handle *ph, case SCMI_EVENT_SENSOR_UPDATE: { int i; + size_t expected_sz; struct scmi_sensor_info *s; const struct scmi_sensor_update_notify_payld *p = payld; struct scmi_sensor_update_report *r = report; struct sensors_info *sinfo = ph->get_priv(ph); - /* payld_sz is variable for this event */ + if (payld_sz < sizeof(*p)) + break; + r->sensor_id = le32_to_cpu(p->sensor_id); if (r->sensor_id >= sinfo->num_sensors) break; @@ -1093,6 +1096,11 @@ scmi_sensor_fill_custom_report(const struct scmi_protocol_handle *ph, * readings defined for this sensor or 1 for scalar sensors. */ r->readings_count = s->num_axis ?: 1; + expected_sz = sizeof(*p) + r->readings_count * + sizeof(p->readings[0]); + if (payld_sz < expected_sz) + break; + for (i = 0; i < r->readings_count; i++) scmi_parse_sensor_readings(&r->readings[i], &p->readings[i]); -- 2.53.0