Re: Bug in arm_scmi driver before v6.10

[Dan Carpenter <dan.carpenter@linaro.org>]

On Wed, Dec 10, 2025 at 11:45:06AM +0000, Amitai Gottlieb wrote:
> 
> BUG DESCRIPTION:
> Function scmi_devm_notifier_unregister<https://elixir.bootlin.com/linux/v5.15/source/drivers/firmware/arm_scmi/notify.c#L1531> always fails with -ENOENT.
> 
> AFFECTED VERSIONS:
> All versions before v6.10

Not really all versions...  The supported versions from kernel.org are
5.15, 6.1 and 6.6.

> 
> ROOT CAUSE:
> Function scmi_devm_notifier_unregister in drivers/firmware/arm_scmi/notify.c ignores the notifier_block parameter. As a consequence,  scmi_devm_notifier_match<https://elixir.bootlin.com/linux/v5.15/source/drivers/firmware/arm_scmi/notify.c#L1498> always fails to match. I've attached a diff file for v5.15 for clarity.
> 
> CONSEQUENCES
> In my use-case, I cannot safely rmmod/insmod  my driver as rmmod fails unregister the SCMI notifier meaning the next insmod causes a double-register which sometimes leads to kernel panic.
> 
> I already reached out to Cristian Marussi (Cristian.Marussi@arm.com) who asked me to report this bug on the mailing list. He also said that it may not be critical enough to fix retroactively. It's also worth noting that in v6.10 Cristian did a small refactor of this code that fixed the aforementioned bug.
> 
> If this bug is critical enough to be patched, I would be happy to take the time to help.
> 
> Thanks,
> Amitai

> diff --git a/drivers/firmware/arm_scmi/notify.c b/drivers/firmware/arm_scmi/notify.c
> index 0efd20cd9d69..4782b115e6ec 100644
> --- a/drivers/firmware/arm_scmi/notify.c
> +++ b/drivers/firmware/arm_scmi/notify.c
> @@ -1539,6 +1539,7 @@ static int scmi_devm_notifier_unregister(struct scmi_device *sdev,
>  	dres.handle = sdev->handle;
>  	dres.proto_id = proto_id;
>  	dres.evt_id = evt_id;
> +	dres.nb = nb;
>  	if (src_id) {
>  		dres.__src_id = *src_id;
>  		dres.src_id = &dres.__src_id;

This seems like a reasonable enough patch.  It needs a proper commit
message and a Signed-off-by.  The Fixes tag would be:
Fixes: 5ad3d1cf7d34 ("firmware: arm_scmi: Introduce new devres notification ops")

Then get some Acks from the list here, and then send it to
stable@vger.kernel.org.  With a note in the metadata section under the
--- cut off that "This is not needed upstream becaues the bug was fixed
in a refactor by commit 264a2c520628 ("firmware: arm_scmi: Simplify
scmi_devm_notifier_unregister").  It is needed for the 5.15, 6.1 and
6.6 kernels.

regards,
dan carpenter