Re: [PATCH] platform: arm64: qcom-hamoa-ec: reject incomplete responses
From: Bryan O'Donoghue
Date: Tue Jul 28 2026 - 07:27:52 EST
On 28/07/2026 12:19, Linmao Li wrote:
qcom_ec_read() accepts short positive transfers, while both callers
unconditionally consume every field in their fixed-size response. A short
transfer can therefore make them use trailing stack bytes that were not
returned by the device.
The first response byte contains the number of payload bytes, excluding
the byte count itself. A complete response of resp_len bytes must
therefore report resp_len - 1 payload bytes. The existing check only
rejects counts that do not fit in the response buffer and still accepts
an incomplete payload.
Require both the SMBus transfer length and the EC-provided payload count
to match the expected response size.
Fixes: 5c44f48e91de ("platform: arm64: Add driver for EC found on Qualcomm reference devices")
Signed-off-by: Linmao Li <lilinmao@xxxxxxxxxx>
---
The resp_len - 1 requirement is based solely on the response layouts
documented in this driver. The EC specification and hardware were not
available, so please confirm it for supported firmware revisions.
Compile-tested with CONFIG_EC_QCOM_HAMOA=m.
drivers/platform/arm64/qcom-hamoa-ec.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/arm64/qcom-hamoa-ec.c b/drivers/platform/arm64/qcom-hamoa-ec.c
index 5ca7308c6077..4d2ad042a7f8 100644
--- a/drivers/platform/arm64/qcom-hamoa-ec.c
+++ b/drivers/platform/arm64/qcom-hamoa-ec.c
@@ -92,8 +92,10 @@ static int qcom_ec_read(struct qcom_ec *ec, u8 cmd, u8 resp_len, u8 *resp)
return ret;
else if (ret == 0 || ret == 0xff)
return -EOPNOTSUPP;
+ else if (ret != resp_len)
+ return -EIO;
- if (resp[0] >= resp_len)
+ if (resp[0] != resp_len - 1)
return -EINVAL;
return 0;
base-commit: c5e32e86ca02b003f86e095d379b38148999293d
The logic stacks-up, interesting to see if the hardware produces blue smoke though.
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@xxxxxxxxxx>