[PATCH 0/2] mailbox: pcc: Fix shared-memory teardown race

[PATCH 0/2] mailbox: pcc: Fix shared-memory teardown race

[Christian Loehle]

Breno’s fix frees the PCC channel before unmapping shared memory, ensuring
the IRQ is disabled first. The second patch serializes channel release and
request so a new mapping cannot be unmapped by the old release.

(I'm happy to have my patch folded into Breno's if that's preferred.)

Breno Leitao (1):
  mailbox: pcc: Free the channel before unmapping the shared memory

Christian Loehle (1):
  mailbox: pcc: Serialize channel updates with shared memory teardown

 drivers/mailbox/pcc.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

-- 
2.34.1

[PATCH 1/2] mailbox: pcc: Free the channel before unmapping the shared memory

[Christian Loehle]

From: Breno Leitao <leitao@debian.org>

I am seeing a crash on PCC that is related to a an shared memory being
unmapped before the IRQ is disabled, and the IRQ kicks in and hits the
unmapped (NULL) address. This is a summary of what I see on my box:

	scmi_protocol scmi_dev.1: Message for 1 type 0 is not expected!
	Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
	 __handle_irq_event_percpu+0x1c4/0x9e0
	 handle_irq_event+0x98/0x218
	 handle_fasteoi_irq+0x230/0x750
	 generic_handle_domain_irq+0xac/0x138
	 gic_handle_irq+0x344/0x740
	 call_on_irq_stack+0x30/0x48

The trapping store is iowrite32(SCMI_SHMEM_FLAG_INTR_ENABLED,
&shmem->header.flags), a write of 1 at offset 4 of a NULL base.

But, back to the problem, pcc_mbox_free_channel() unmaps the shared
memory and clears pchan->chan.shmem *before* freeing the IRQ (aka
calling mbox_free_channel()).

The interrupt is still live when the mapping goes away.

Free the channel first, before the memory unmap. mbox_free_channel()
calls pcc_shutdown(), which frees the platform interrupt, and then unmap
shared memory.

Fixes: 7f9e19f207be ("mailbox: pcc: Check before sending MCTP PCC response ACK")
Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 drivers/mailbox/pcc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 9888dab64639..db30812c5051 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -438,12 +438,13 @@ void pcc_mbox_free_channel(struct pcc_mbox_chan *pchan)
 		return;
 	pchan_info = chan->con_priv;
 	pcc_mbox_chan = &pchan_info->chan;
+
+	mbox_free_channel(chan);
+
 	if (pcc_mbox_chan->shmem) {
 		iounmap(pcc_mbox_chan->shmem);
 		pcc_mbox_chan->shmem = NULL;
 	}
-
-	mbox_free_channel(chan);
 }
 EXPORT_SYMBOL_GPL(pcc_mbox_free_channel);
 
-- 
2.34.1

[PATCH 2/2] mailbox: pcc: Serialize channel updates with shared memory teardown

[Christian Loehle]

mbox_free_channel() makes a PCC channel available before the subsequent
shared-memory unmap. Without serialization, a concurrent request can bind a
new client and replace the mapping, which the old release then unmaps.

Serialize PCC channel acquisition and release. Keep the channel unavailable
until the old shared-memory mapping has been removed.

Suggested-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Christian Loehle <christian.loehle@arm.com>
---
 drivers/mailbox/pcc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index db30812c5051..14dc4a187bfc 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -53,6 +53,7 @@
 #include <linux/interrupt.h>
 #include <linux/list.h>
 #include <linux/log2.h>
+#include <linux/mutex.h>
 #include <linux/platform_device.h>
 #include <linux/mailbox_controller.h>
 #include <linux/mailbox_client.h>
@@ -113,6 +114,7 @@ struct pcc_chan_info {
 #define to_pcc_chan_info(c) container_of(c, struct pcc_chan_info, chan)
 static struct pcc_chan_info *chan_info;
 static int pcc_chan_count;
+static DEFINE_MUTEX(pcc_chan_mutex);
 
 /*
  * PCC can be used with perf critical drivers such as CPPC
@@ -392,6 +394,8 @@ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id)
 	if (subspace_id < 0 || subspace_id >= pcc_chan_count)
 		return ERR_PTR(-ENOENT);
 
+	guard(mutex)(&pcc_chan_mutex);
+
 	pchan = chan_info + subspace_id;
 	chan = pchan->chan.mchan;
 	if (IS_ERR(chan) || chan->cl) {
@@ -434,6 +438,8 @@ void pcc_mbox_free_channel(struct pcc_mbox_chan *pchan)
 	struct pcc_chan_info *pchan_info;
 	struct pcc_mbox_chan *pcc_mbox_chan;
 
+	guard(mutex)(&pcc_chan_mutex);
+
 	if (!chan || !chan->cl)
 		return;
 	pchan_info = chan->con_priv;
-- 
2.34.1

Re: [PATCH 2/2] mailbox: pcc: Serialize channel updates with shared memory teardown

[Sudeep Holla]

On Thu, Sep 03, 2026 at 12:13:28PM +0100, Christian Loehle wrote:
> mbox_free_channel() makes a PCC channel available before the subsequent
> shared-memory unmap. Without serialization, a concurrent request can bind a
> new client and replace the mapping, which the old release then unmaps.
> 
> Serialize PCC channel acquisition and release. Keep the channel unavailable
> until the old shared-memory mapping has been removed.
> 
> Suggested-by: Sudeep Holla <sudeep.holla@kernel.org>

Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org>

-- 
Regards,
Sudeep

Re: [PATCH 0/2] mailbox: pcc: Fix shared-memory teardown race

[Sudeep Holla]

Hi Jassi,

On Thu, Sep 03, 2026 at 12:13:26PM +0100, Christian Loehle wrote:
> Breno’s fix frees the PCC channel before unmapping shared memory, ensuring
> the IRQ is disabled first. The second patch serializes channel release and
> request so a new mapping cannot be unmapped by the old release.
> 

Can you please pull these couple of patches as fixes for v7.3 when
possible ?

-- 
Regards,
Sudeep