From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 598F44534B3; Tue, 16 Jun 2026 16:05:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781625936; cv=none; b=dsQ4X4LCss4KjSMx7AvsTO8d4p/ONq/mz+OCykJ9E5r7X1mgiQP3XKvoJq6Uca3fl17JDT3TJ5J/8w3rdzW4OSejZvybDBEeEsIEjDL5c54f5LHBSEp36xp7d7Wofd5LPrmV9bOnaWoLX6g6XS67kr03bx9C0E/dNmrJ1jopnzc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781625936; c=relaxed/simple; bh=UHrXYLQtU5QQDNjsRpctGYYI9+qq7mlksw5nWut+7rM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZhTAcmh28jAsDBO0g6+LxFLwl8MjLUpDYEjqYFXn15Uwz8YnrmWrFQP8pALBUM3cVYy2kPMwLNp+bW/aRJCIZckiKGDTAxTZThSDXjEsbl1bw1i29b7unEhyITMzI9Qr8HgAZD29ix1iS/nqfm28KOTE9iMKEReomhSIlfVQcGU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qSkaisx1; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="qSkaisx1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6997D1F000E9; Tue, 16 Jun 2026 16:05:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781625935; bh=v8Erml6ATnLfAj5FoIjCS9jdOijWx/6ZRgEKxN9U0h8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qSkaisx1vaCHBO0w0cG/WqfUqDCp1jbgaFxs6c2KyGMXihm1fRgbRFLHsu2obm+tj NuwZEzZqaqg8EWBNtDuP+gtME/6p8YMBIE+LTewwolkYAvg1ZRkCEZdpOV0U9yE+Ug vWoaW0u6YFZqQjYTgCivbqy999qJITVAHP4fZqP8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tudor Ambarus , Krzysztof Kozlowski Subject: [PATCH 6.18 235/325] firmware: samsung: acpm: Fix mailbox channel leak on probe error Date: Tue, 16 Jun 2026 20:30:31 +0530 Message-ID: <20260616145110.134284301@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260616145057.827196531@linuxfoundation.org> References: <20260616145057.827196531@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tudor Ambarus commit b66829b17f6385cc9ffbcbe2476d532d2e3121ad upstream. Sashiko identified the leak at [1]. The ACPM driver allocates hardware mailbox channels using `mbox_request_channel()` during `acpm_channels_init()`. However, the driver lacked a `.remove` callback and did not free these channels on subsequent error paths inside `acpm_probe()`. Additionally, if `acpm_achan_alloc_cmds()` failed during the channel initialization loop, the function returned immediately, bypassing the manual cleanup and permanently leaking any channels successfully requested in previous loop iterations. Fix this by modifying `acpm_free_mbox_chans()` to match the `devres` action signature and registering it via `devm_add_action_or_reset()`. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org [1] Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-2-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Greg Kroah-Hartman --- drivers/firmware/samsung/exynos-acpm.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -523,10 +523,11 @@ static int acpm_achan_alloc_cmds(struct /** * acpm_free_mbox_chans() - free mailbox channels. - * @acpm: pointer to driver data. + * @data: pointer to driver data. */ -static void acpm_free_mbox_chans(struct acpm_info *acpm) +static void acpm_free_mbox_chans(void *data) { + struct acpm_info *acpm = data; int i; for (i = 0; i < acpm->num_chans; i++) @@ -554,6 +555,10 @@ static int acpm_channels_init(struct acp if (!acpm->chans) return -ENOMEM; + ret = devm_add_action_or_reset(dev, acpm_free_mbox_chans, acpm); + if (ret) + return dev_err_probe(dev, ret, "Failed to add mbox free action.\n"); + chans_shmem = acpm->sram_base + readl(&shmem->chans); for (i = 0; i < acpm->num_chans; i++) { @@ -575,10 +580,8 @@ static int acpm_channels_init(struct acp cl->dev = dev; achan->chan = mbox_request_channel(cl, 0); - if (IS_ERR(achan->chan)) { - acpm_free_mbox_chans(acpm); + if (IS_ERR(achan->chan)) return PTR_ERR(achan->chan); - } } return 0;