Re: [PATCH v2 2/3] firmware: qcom_scm: handle empty PAS resource table

[Bartosz Golaszewski]

On Tue, 22 Sep 2026 12:42:57 +0200, Konrad Dybcio
<konrad.dybcio@xxxxxxxxxxxxxxxx> said:
> On 9/21/26 9:56 PM, Mukesh Ojha wrote:
>> The PAS resource-table query may successfully return a zero-sized
>> table. kmemdup() with a zero length returns ZERO_SIZE_PTR,
>> which is stored in rproc->table_ptr. The remoteproc core then
>> dereferences this invalid pointer while processing resources.
>>
>> Treat a zero-sized result as an absent resource table and return
>> NULL after releasing the TrustZone memory buffer. This allows the
>> remoteproc core to skip resource-table processing.
>>
>> Fixes: 8b9d2050cfa0 ("firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table")
>> Signed-off-by: Mukesh Ojha <mukesh.ojha@xxxxxxxxxxxxxxxx>
>> ---
>
> Reviewed-by: Konrad Dybcio <konrad.dybcio@xxxxxxxxxxxxxxxx>
>
>
>> Changes in v2:
>>  - New change.
>>
>>  drivers/firmware/qcom/qcom_scm.c | 10 +++++++++-
>>  1 file changed, 9 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
>> index df20773dd754..b5959f833dd7 100644
>> --- a/drivers/firmware/qcom/qcom_scm.c
>> +++ b/drivers/firmware/qcom/qcom_scm.c
>> @@ -823,6 +823,14 @@ static void *qcom_scm_pas_get_rsc_table(struct device *dev,
>>  		goto free_input_rt;
>>  	}
>>
>> +	*output_rt_size = size;
>> +
>> +	/* A zero-sized table means that TrustZone has no resource table. */
>> +	if (!size) {
>> +		tbl_ptr = NULL;
>> +		goto free_output_rt;
>> +	}
>> +
>>  	tbl_ptr = kmemdup(output_rt_tzm, size, GFP_KERNEL);
>>  	if (!tbl_ptr) {
>>  		qcom_tzmem_free(output_rt_tzm);
>
> ^ this hunk can additionally be remodeled to jump to this new label
> too
>

This wouldn't be needed if with my series using cleanup.h[1] in this driver.

Just sayin'... :)

Bart

[1] https://lore.kernel.org/all/20260903-qcom-scm-code-shrink-v3-0-8237f3a654e1@xxxxxxxxxxxxxxxx/