[PATCH 2/3] firmware: arm_scmi: imx: Validate MISC control response size

[Peng Fan]

On Wed, Oct 28, 2026 at 01:05:01PM +0000, Sudeep Holla wrote:
>scmi_imx_misc_ctrl_get() uses @num to report the number of
>values returned by firmware, but it did not retain the caller's value
>as the capacity of @val.
>
>A response with more values than the caller allocated was copied into
>@val unchecked. For example, the MQS regmap callback supplies storage
>for one value. Retain the input capacity and reject responses exceeding
>it before copying, then update @num only after a successful copy.
>
>Document the in/out @num contract of the exported helper.
>
>Reported-by: Sashiko <sashiko-bot at kernel.org>
>Closes: https://sashiko.dev/#/bug/linux-6897b44a-57fb-4964-95f8-447d0ce526e4
>Fixes: 61c9f03e22fc ("firmware: arm_scmi: Add initial support for i.MX MISC protocol")
>Signed-off-by: Sudeep Holla <sudeep.holla at kernel.org>

Reviewed-by: Peng Fan <peng.fan at nxp.com>