From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 76EF0C83F19 for ; Tue, 29 Aug 2023 17:08:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:To:Date:Message-Id:Subject:Mime-Version :From:Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=jL29C48SccWZKTv2N64rTBLFNIa+XlGYpjLOYtBzDds=; b=dG+dmOjqEXZ2ms MNeava0byhLK9tqJyw2hVmIuMsCc0KgLlt5tpcewW/3q+qkss2tKhf1X6C6ZijcQLanRBhnnFrmX7 b6aOHitAb6ZckGQ0ufANn+eBLZKt36oTKne/OT5RCaGCXNWLOlvm2wNOmAIUnagHQwEwjmb8GgVnL WcWLsYRkgjtEmdwPn2xZutMuM8cUNwEsorNayIlaRQm/c40iKWr/1i1h2/ZJsqGE4wpGWj2jSsTHp udKSzYPET+az8wJNerVWnCGzqKdAt7Mt2JDFYNnEj3svwGgGcifjDX1fbsQ9C/X5SABvlzAanObpC /D97m4orQhFwnZzHSTkg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qb2C7-00BuVL-2C; Tue, 29 Aug 2023 17:07:59 +0000 Received: from mail-pl1-x62c.google.com ([2607:f8b0:4864:20::62c]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qb2C5-00BuUJ-0S for linux-arm-kernel@lists.infradead.org; Tue, 29 Aug 2023 17:07:58 +0000 Received: by mail-pl1-x62c.google.com with SMTP id d9443c01a7336-1bf078d5f33so37190015ad.3 for ; Tue, 29 Aug 2023 10:07:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1693328873; x=1693933673; h=to:date:message-id:subject:mime-version:content-transfer-encoding :from:from:to:cc:subject:date:message-id:reply-to; bh=6tNh2jrop/C5GKzOfIBsmoKZX+iK/CaYp9fou2Xs6XE=; b=iU2QqkaYRXRLf0tzT8s1le6jWGSQ05Coj+/gbVAZ4J+xgHf5tw1G4dLthNPnU5NaY5 cxGwYATXPkWmU6PCm9AUa97hnqbRnYJ0RFbq/Dma7+9BmZErPUuG/TVMvEXh7ECVFPc9 1XcIWXz4ELndL/nIAxCD7rdaj7/TO5XigNAwcrFNIhQvGRI1D98QPAdqjyg8/2pjYnGB BH3f4cVQYgktKr15zUc+BP+DTfi3Tjfb2a1xjN5Gd/Q2uR4M4pjIqsuht3IoBMn9/CTs kd7M+avgPe7MGmAWlyrBnK7w63jH7EwFnTjBXS6FgPWCAHV41jl9tmymyarRDSZSSEoU VBwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1693328873; x=1693933673; h=to:date:message-id:subject:mime-version:content-transfer-encoding :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=6tNh2jrop/C5GKzOfIBsmoKZX+iK/CaYp9fou2Xs6XE=; b=ciHAG6GgdlJKCjvWEqqSJf1QTZoddVfG1J1KpFC9gqLxh6k+W4FQ+aoSm6uQpKAa2x IO5+gTQTvDbzWUBsBjmAefaau96rnjyVh4AlryjU2qCk33U5nTiDE+bxzUvwmgm50M/a hIAxl+s+yGDqqnGQwaVS6vw75+G1J5nq/VR4LHewsTobuSHa7KfrT/d82mkaOw8jGEi0 7erugiZavsRSr97uGDQ0IVEv9Zs0YPrKQj9EzTwn3iWCz0fcpRxQ/6Xy85/ss5UqUeW+ LJMA7QQLZP371Py44j0CCG0GPr1+blh6TDCInAsmJ+FIkFlghp0MYCQ8w6pquEkDgiYr aSJA== X-Gm-Message-State: AOJu0YyC125pdiTYo4kSuZTGXpXrSXfxi5p1DBuHB9fgtg5fXqrvsCLr D2abnA68yyLi8ELArGGDuSmRoUPoolebXA== X-Google-Smtp-Source: AGHT+IH9gcboZj3L3HH5W3y5Xnn553TJ1PvT6ETiyDaADG1aspu7MVP0BidaPJIFoHmyFEX8Jhispg== X-Received: by 2002:a17:902:dacf:b0:1c0:b8fd:9c6 with SMTP id q15-20020a170902dacf00b001c0b8fd09c6mr18456383plx.42.1693328872671; Tue, 29 Aug 2023 10:07:52 -0700 (PDT) Received: from [127.0.0.1] ([103.135.102.121]) by smtp.gmail.com with ESMTPSA id v11-20020a170902d68b00b001bf11cf2e21sm9579314ply.210.2023.08.29.10.07.50 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 29 Aug 2023 10:07:52 -0700 (PDT) From: Qiujun Huang Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Subject: [PATCH v1] firmware: arm_scmi: Fix NULL pointer dereference in mailbox_clear_channel Message-Id: Date: Wed, 30 Aug 2023 01:07:47 +0800 To: sudeep.holla@arm.com, cristian.marussi@arm.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org X-Mailer: Apple Mail (2.3608.120.23.2.1) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230829_100757_180849_524F87C5 X-CRM114-Status: GOOD ( 13.04 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org There is a race between the failure of probe and rx_callback (due to a delayed response). scmi_probe scmi_acquire_protocal do_xfer timeout mailbox_chan_free <--- delay response rx_callback mbox_free_channel cinfo->transport_info = NULL mailbox_clear_channel dereference cinfo->transport_info This patch check for it, and clear the channel at mailbox_chan_free. Signed-off-by: Qiujun Huang --- drivers/firmware/arm_scmi/mailbox.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/arm_scmi/mailbox.c b/drivers/firmware/arm_scmi/mailbox.c index 19246ed1f01f..32c5fe0b8c29 100644 --- a/drivers/firmware/arm_scmi/mailbox.c +++ b/drivers/firmware/arm_scmi/mailbox.c @@ -230,6 +230,7 @@ static int mailbox_chan_free(int id, void *p, void *data) smbox->chan = NULL; smbox->chan_receiver = NULL; smbox->cinfo = NULL; + shmem_clear_channel(smbox->shmem); } return 0; @@ -284,7 +285,8 @@ static void mailbox_clear_channel(struct scmi_chan_info *cinfo) { struct scmi_mailbox *smbox = cinfo->transport_info; - shmem_clear_channel(smbox->shmem); + if (smbox) + shmem_clear_channel(smbox->shmem); } static bool -- 2.30.2 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel