From nobody Fri Oct 3 14:34:25 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 164BC6FC5; Fri, 29 Aug 2025 13:23:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756473819; cv=none; b=QM/ZHfCsrtW1NR9xHtOJq+r5204bnaLJNHU3JrRrkw1oKO1+1yeS5jb5mpAGS4nKi43qKTfebMI/lyipN0+7Ux8t4hTNJEmoZGnNz1MmPyHVzK6wbKirFKRd+6ny1BSBX8IDcSuP96Bbw7aB64o6KD0O+78jJ3tx2mPURbqPrAs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756473819; c=relaxed/simple; bh=uftIey/kDewVzHrnVcmLL9rZu1wmE0j/IP3oDq/orCg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=V/dTgD9qO3rRovTxenB4o3a3XuhKxO6gbgMtQ+w/Gq1K1RmRTm/YN1BnlheWvYSJcPYZprgclmxHnsKvHxU/8JcG5rko4dQwfNOaYDfnW1oy9j3w+uifwjhWeALjYxb06liLPIWpmZTYZjl5DjmAWeRvLJeKNiNb9h/doLEedk8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=PJuP1z9e; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="PJuP1z9e" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83FFAC4CEF0; Fri, 29 Aug 2025 13:23:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756473818; bh=uftIey/kDewVzHrnVcmLL9rZu1wmE0j/IP3oDq/orCg=; h=From:To:Cc:Subject:Date:From; b=PJuP1z9eXFKD227sW1+apYQKx4mRlPB33arzkfsePLcHJtm0ctJwbjDz5EEfcfJfr EGX4FPrdYYHFYtBjKnr9aKnDgY6POkABESlAvsBLQ+3QFppyeps+HsQ4kef+zdCp5N tMlBM7tjaxIvv1OS8yWleE641mW/ZXL1bz8qiS0yaUvR5sE5nf1fHDN6wV3CCELrLc F8D+zCkSMBxmRH8pne717bGqaBXBVzCh69D0ztIVyhunYOGYRYEu3hw3DKvLwzR/CN Brm5Rs9FhJs/WagMKa6UMFRKIYPNKdUZWJ/TJ5Y1ffuZ8T08xwiy8tRDOMVk2LLw2w tgMnsEPIq1fyA== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1urz4h-000000007N7-3tyo; Fri, 29 Aug 2025 15:23:28 +0200 From: Johan Hovold To: Sudeep Holla Cc: Cristian Marussi , arm-scmi@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH] firmware: arm_scmi: quirk: fix write to string constant Date: Fri, 29 Aug 2025 15:21:52 +0200 Message-ID: <20250829132152.28218-1-johan@kernel.org> X-Mailer: git-send-email 2.49.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The quirk version range is typically a string constant and must not be modified (e.g. as it may be stored in read-only memory): Unable to handle kernel write to read-only memory at virtual address ffffc036d998a947 Fix the range parsing so that it operates on a copy of the version range string, and mark all the quirk strings as const to reduce the risk of introducing similar future issues. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220437 Fixes: 487c407d57d6 ("firmware: arm_scmi: Add common framework to handle fi= rmware quirks") Cc: stable@vger.kernel.org # 6.16 Cc: Cristian Marussi Signed-off-by: Johan Hovold Reported-by: Jan Palus Reviewed-by: Cristian Marussi --- drivers/firmware/arm_scmi/quirks.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/firmware/arm_scmi/quirks.c b/drivers/firmware/arm_scmi= /quirks.c index 03960aca3610..e70823754b0b 100644 --- a/drivers/firmware/arm_scmi/quirks.c +++ b/drivers/firmware/arm_scmi/quirks.c @@ -89,9 +89,9 @@ struct scmi_quirk { bool enabled; const char *name; - char *vendor; - char *sub_vendor_id; - char *impl_ver_range; + const char *vendor; + const char *sub_vendor_id; + const char *impl_ver_range; u32 start_range; u32 end_range; struct static_key_false *key; @@ -217,7 +217,7 @@ static unsigned int scmi_quirk_signature(const char *ve= nd, const char *sub_vend) =20 static int scmi_quirk_range_parse(struct scmi_quirk *quirk) { - const char *last, *first =3D quirk->impl_ver_range; + const char *last, *first; size_t len; char *sep; int ret; @@ -228,8 +228,12 @@ static int scmi_quirk_range_parse(struct scmi_quirk *q= uirk) if (!len) return 0; =20 + first =3D kmemdup(quirk->impl_ver_range, len + 1, GFP_KERNEL); + if (!first) + return -ENOMEM; + last =3D first + len - 1; - sep =3D strchr(quirk->impl_ver_range, '-'); + sep =3D strchr(first, '-'); if (sep) *sep =3D '\0'; =20 @@ -238,7 +242,7 @@ static int scmi_quirk_range_parse(struct scmi_quirk *qu= irk) else /* X OR X- OR X-y */ ret =3D kstrtouint(first, 0, &quirk->start_range); if (ret) - return ret; + goto out_free; =20 if (!sep) quirk->end_range =3D quirk->start_range; @@ -246,7 +250,9 @@ static int scmi_quirk_range_parse(struct scmi_quirk *qu= irk) ret =3D kstrtouint(sep + 1, 0, &quirk->end_range); =20 if (quirk->start_range > quirk->end_range) - return -EINVAL; + ret =3D -EINVAL; +out_free: + kfree(first); =20 return ret; } --=20 2.49.1