[PATCH 1/2] firmware: qcom: pas-tee: Always initialize resource table output size

[Krzysztof Kozlowski]

qcom_pas_tee_get_rsc_table() sets the "output_rt_size" only when the first
TEE invocation reports a size smaller than the input table, or when the
second invocation returns a non-zero size.  If the TEE reports a size
bigger or equal to the input size on the first call, but then returns
size of 0 on the second call, the function returns NULL (no table) and
leaves "output_rt_size" output parameter untouched.

Caller of qcom_pas_tee_get_rsc_table() treats NULL as success, thus
uninitialized "output_rt_size" output argument could in theory lead to
out-of-bounds accesses further.

Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Closes: https://sashiko.dev/#/bug/linux-bb15726c-4185-460a-a5f0-f779d5ee144a
Fixes: b6f7978da0c4 ("firmware: qcom: Add a PAS TEE service")
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxxxxxxxx>
---
 drivers/firmware/qcom/qcom_pas_tee.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/firmware/qcom/qcom_pas_tee.c b/drivers/firmware/qcom/qcom_pas_tee.c
index ac33a00687aa..ba9957023ec8 100644
--- a/drivers/firmware/qcom/qcom_pas_tee.c
+++ b/drivers/firmware/qcom/qcom_pas_tee.c
@@ -275,6 +275,8 @@ static void *qcom_pas_tee_get_rsc_table(struct device *dev,
 			rt_buf = kmemdup(rt_shm_va, *output_rt_size, GFP_KERNEL);
 			if (!rt_buf)
 				return ERR_PTR(-ENOMEM);
+		} else {
+			*output_rt_size = 0;
 		}
 	} else {
 		*output_rt_size = 0;
-- 
2.53.0