[PATCH 05/11] firmware: arm_scmi: stop reading past PINCTRL_LIST_ASSOCIATIONS replies
From: Clément Le Goffic
Date: Fri Oct 30 2026 - 12:03:17 EST
The transport cuts a reply larger than the receive buffer, but the iterator
still reads every identifier the reply announces. Use only the identifiers
that were copied and ask again for the others.
Fixes: 2145af01b9cb ("firmware: arm_scmi: Add basic support for SCMI v3.2 pincontrol protocol")
Signed-off-by: Clément Le Goffic <clegoffic@xxxxxxxxxxxx>
---
drivers/firmware/arm_scmi/pinctrl.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/firmware/arm_scmi/pinctrl.c b/drivers/firmware/arm_scmi/pinctrl.c
index 42cb1aef1fe1..69645ce73d9d 100644
--- a/drivers/firmware/arm_scmi/pinctrl.c
+++ b/drivers/firmware/arm_scmi/pinctrl.c
@@ -261,10 +261,22 @@ static int iter_pinctrl_assoc_update_state(struct scmi_iterator_state *st,
const void *response, void *priv)
{
const struct scmi_resp_pinctrl_list_assoc *r = response;
+ unsigned int nr_fit = 0;
st->num_returned = RETURNED(r->flags);
st->num_remaining = REMAINING(r->flags);
+ if (st->rx_len > sizeof(*r))
+ nr_fit = (st->rx_len - sizeof(*r)) / sizeof(r->array[0]);
+
+ if (st->num_returned > nr_fit) {
+ if (!nr_fit)
+ return -EPROTO;
+
+ st->num_remaining += st->num_returned - nr_fit;
+ st->num_returned = nr_fit;
+ }
+
return 0;
}
--
2.56.0