Re: [PATCH 1/2] firmware: qcom: pas-tee: Always initialize resource table output size

[Konrad Dybcio]

On 11/2/26 4:01 PM, Krzysztof Kozlowski wrote:
> qcom_pas_tee_get_rsc_table() sets the "output_rt_size" only when the first
> TEE invocation reports a size smaller than the input table, or when the
> second invocation returns a non-zero size.  If the TEE reports a size
> bigger or equal to the input size on the first call, but then returns
> size of 0 on the second call, the function returns NULL (no table) and
> leaves "output_rt_size" output parameter untouched.
> 
> Caller of qcom_pas_tee_get_rsc_table() treats NULL as success, thus
> uninitialized "output_rt_size" output argument could in theory lead to
> out-of-bounds accesses further.
> 
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/bug/linux-bb15726c-4185-460a-a5f0-f779d5ee144a
> Fixes: b6f7978da0c4 ("firmware: qcom: Add a PAS TEE service")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxxxxxxxx>
> ---


Reviewed-by: Konrad Dybcio <konrad.dybcio@xxxxxxxxxxxxxxxx>

Konrad