• Cristian Marussi's avatar
    firmware: arm_scmi: Avoid using extended string-buffers sizes if not necessary · 4314f9f4
    Cristian Marussi authored
    Commit b260fcca ("firmware: arm_scmi: Add SCMI v3.1 protocol extended
    names support") moved all the name string buffers to use the extended buffer
    size of 64 instead of the required 16 bytes. While that should be fine if
    the firmware terminates the string before 16 bytes, there is possibility
    of copying random data if the name is not NULL terminated by the firmware.
    
    SCMI base protocol agent_name/vendor_id/sub_vendor_id are defined by the
    specification as NULL-terminated ASCII strings up to 16-bytes in length.
    
    The underlying buffers and message descriptors are currently bigger than
    needed; resize them to fit only the strictly needed 16 bytes to avoid
    any possible leaks when reading data from the firmware.
    
    Change the size argument of strlcpy to use SCMI_SHORT_NAME_MAX_SIZE always
    when dealing with short domain names, so as to limit the possibility that
    an ill-formed non-NULL terminated short reply from the SCMI platform
    firmware can leak stale content laying in the underlying transport shared
    memory area.
    
    While at that, convert all strings handling routines to use the preferred
    strscpy.
    
    Link: https://lore.kernel.org/r/20220608095530.497879-1-cristian.marussi@arm.com
    Fixes: b260fcca ("firmware: arm_scmi: Add SCMI v3.1 protocol extended names support")
    Signed-off-by: default avatarCristian Marussi <cristian.marussi@arm.com>
    Signed-off-by: default avatarSudeep Holla <sudeep.holla@arm.com>
    4314f9f4
reset.c 8.39 KB