2024-01-10 12:20:24

by Cristian Marussi

Subject: [PATCH] firmware: arm_scmi: Rework Clock domains info lookups

Accessing Clock domains descriptors by the index from the SCMI drivers
can potentially lead to out-of-bound violations if the SCMI drivers
misbehaves.

Use a common helper to check the consistency of such accesses.

Signed-off-by: Cristian Marussi <[email protected]>
---
drivers/firmware/arm_scmi/clock.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
index b76ff23721df..ff1aa04e5a10 100644
--- a/drivers/firmware/arm_scmi/clock.c
+++ b/drivers/firmware/arm_scmi/clock.c
@@ -167,6 +167,15 @@ static enum scmi_clock_protocol_cmd evt_2_cmd[] = {
CLOCK_RATE_CHANGE_REQUESTED_NOTIFY,
};

+static inline struct scmi_clock_info *
+scmi_clock_domain_lookup(struct clock_info *ci, u32 clk_id)
+{
+ if (clk_id >= ci->num_clocks)
+ return ERR_PTR(-EINVAL);
+
+ return ci->clk + clk_id;
+}
+
static int
scmi_clock_protocol_attributes_get(const struct scmi_protocol_handle *ph,
struct clock_info *ci)
@@ -580,10 +589,9 @@ scmi_clock_set_parent(const struct scmi_protocol_handle *ph, u32 clk_id,
struct clock_info *ci = ph->get_priv(ph);
struct scmi_clock_info *clk;

- if (clk_id >= ci->num_clocks)
- return -EINVAL;
-
- clk = ci->clk + clk_id;
+ clk = scmi_clock_domain_lookup(ci, clk_id);
+ if (IS_ERR(clk))
+ return PTR_ERR(clk);

if (parent_id >= clk->num_parents)
return -EINVAL;
@@ -800,10 +808,10 @@ scmi_clock_info_get(const struct scmi_protocol_handle *ph, u32 clk_id)
struct scmi_clock_info *clk;
struct clock_info *ci = ph->get_priv(ph);

- if (clk_id >= ci->num_clocks)
+ clk = scmi_clock_domain_lookup(ci, clk_id);
+ if (IS_ERR(clk))
return NULL;

- clk = ci->clk + clk_id;
if (!clk->name[0])
return NULL;

--
2.43.0

2024-02-22 07:54:44

by Sudeep Holla

Subject: Re: [PATCH] firmware: arm_scmi: Rework Clock domains info lookups

On Wed, 10 Jan 2024 12:09:16 +0000, Cristian Marussi wrote:
> Accessing Clock domains descriptors by the index from the SCMI drivers
> can potentially lead to out-of-bound violations if the SCMI drivers
> misbehaves.
>
> Use a common helper to check the consistency of such accesses.
>
>
> [...]

Applied to sudeep.holla/linux (for-next/scmi/updates), thanks!

[1/1] firmware: arm_scmi: Rework Clock domains info lookups
https://git.kernel.org/sudeep.holla/c/dea893a66cd5
--
Regards,
Sudeep