Re: [PATCH RFC v2 01/10] mailbox: add direct synchronous send support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mbox: missing check for send_data ops when binding async clients causes NULL dereference
--

commit 32ed128a065b48b8882da987a95570f9f1da93f8
Author: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>

mailbox: add direct synchronous send support

This commit introduces a direct synchronous send path, allowing controllers
to complete transactions within the calling context without the TX state
machine. It adds the send_data_sync operation and validates that clients
requesting synchronous transmission are bound to compatible controllers.

> diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
> index efacd24a085d1..c640b19de6080 100644
> --- a/drivers/mailbox/mailbox.c
> +++ b/drivers/mailbox/mailbox.c

[ ... ]

> @@ -355,6 +412,14 @@ static int __mbox_bind_client(struct mbox_chan *chan, struct mbox_client *cl)
>  	struct device *dev = cl->dev;
>  	int ret;
>  
> +	if (cl->tx_sync) {
> +		if (!chan->mbox->ops->send_data_sync)
> +			return -EOPNOTSUPP;
> +
> +		if (cl->tx_block || cl->tx_tout || cl->knows_txdone)
> +			return -EINVAL;
> +	}
> +

[Severity: High]
If a controller implements only the new send_data_sync path, could a legacy
asynchronous client (where cl->tx_sync is false) successfully bind to it?

If this happens, wouldn't mbox_send_message() unconditionally execute
chan->mbox->ops->send_data() inside msg_submit():

drivers/mailbox/mailbox.c:msg_submit() {
    ...
		if (chan->cl->tx_prepare)
			chan->cl->tx_prepare(chan->cl, data);
		/* Try to submit a message to the MBOX controller */
		err = chan->mbox->ops->send_data(chan, data);
		if (!err) {
    ...
}

Will this cause a NULL pointer dereference? Does __mbox_bind_client() need a
reciprocal check to ensure chan->mbox->ops->send_data exists when
cl->tx_sync is false?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261007-riscv-rpmi-tee-abi-v2-0-45939a13d223@oss.qualcomm.com?part=1