Re: [PATCH v2 2/3] firmware: qcom_scm: handle empty PAS resource table

[Konrad Dybcio]

On 9/21/26 9:56 PM, Mukesh Ojha wrote:
> The PAS resource-table query may successfully return a zero-sized
> table. kmemdup() with a zero length returns ZERO_SIZE_PTR,
> which is stored in rproc->table_ptr. The remoteproc core then
> dereferences this invalid pointer while processing resources.
> 
> Treat a zero-sized result as an absent resource table and return
> NULL after releasing the TrustZone memory buffer. This allows the
> remoteproc core to skip resource-table processing.
> 
> Fixes: 8b9d2050cfa0 ("firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table")
> Signed-off-by: Mukesh Ojha <mukesh.ojha@xxxxxxxxxxxxxxxx>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@xxxxxxxxxxxxxxxx>


> Changes in v2:
>  - New change.
> 
>  drivers/firmware/qcom/qcom_scm.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
> index df20773dd754..b5959f833dd7 100644
> --- a/drivers/firmware/qcom/qcom_scm.c
> +++ b/drivers/firmware/qcom/qcom_scm.c
> @@ -823,6 +823,14 @@ static void *qcom_scm_pas_get_rsc_table(struct device *dev,
>  		goto free_input_rt;
>  	}
>  
> +	*output_rt_size = size;
> +
> +	/* A zero-sized table means that TrustZone has no resource table. */
> +	if (!size) {
> +		tbl_ptr = NULL;
> +		goto free_output_rt;
> +	}
> +
>  	tbl_ptr = kmemdup(output_rt_tzm, size, GFP_KERNEL);
>  	if (!tbl_ptr) {
>  		qcom_tzmem_free(output_rt_tzm);

^ this hunk can additionally be remodeled to jump to this new label
too

Konrad