Re: [PATCH v33 4/7] firmware: imx: device context dedicated to priv

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] DMA buffer UAF when `ele_msg_send_rcv()` times out in `ele_get_info()`.
--

--- Patch [4]: [PATCH v33 4/7] firmware: imx: device context dedicated to priv ---
commit 27c9de28d615ebae1d88d019d8d364c4ca4999e1
Author: Pankaj Gupta <pankaj.gupta@nxp.com>

firmware: imx: device context dedicated to priv

Add priv_dev_ctx to prepare enabling misc-device context based send-receive
path, to communicate with FW.

No functionality change.

> diff --git a/drivers/firmware/imx/ele_base_msg.c b/drivers/firmware/imx/ele_base_msg.c
> index 724f6e913ce79..b70e3ef88a168 100644
> --- a/drivers/firmware/imx/ele_base_msg.c
> +++ b/drivers/firmware/imx/ele_base_msg.c
> @@ -71,8 +71,9 @@ int ele_get_info(struct se_if_priv *priv, struct ele_dev_info *s_info)
>  	tx_msg->data[0] = upper_32_bits(get_info_addr);
>  	tx_msg->data[1] = lower_32_bits(get_info_addr);
>  	tx_msg->data[2] = sizeof(*s_info);
> -	ret = ele_msg_send_rcv(priv, tx_msg, ELE_GET_INFO_REQ_MSG_SZ, rx_msg,
> -			       ELE_GET_INFO_RSP_MSG_SZ);
> +
> +	ret = ele_msg_send_rcv(priv->priv_dev_ctx, tx_msg, ELE_GET_INFO_REQ_MSG_SZ,
> +			       rx_msg, ELE_GET_INFO_RSP_MSG_SZ);
>  	if (ret < 0) {
>  		ele_get_info_cleanup(priv, get_info_data, get_info_addr, get_info_len);
>  		return ret;

[Severity: Critical]
Does this code risk a DMA use-after-free if the firmware command times out?

If ele_msg_send_rcv() times out and returns -ETIMEDOUT, the error path
calls ele_get_info_cleanup(), which frees the DMA buffer back to the system.

Since the firmware command was not aborted, if the firmware is delayed and
responds later, it may complete the operation and perform a DMA write of the
device info directly into the now-freed memory. This could cause silent memory
corruption of whichever subsystem reallocated the physical page.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260805-imx-se-if-v33-0-212e32ff0295@nxp.com?part=4