From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BAEF63B42E1 for ; Wed, 17 Jun 2026 11:07:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781694450; cv=none; b=QmaFqyT/+mO3mhPTaIsjvak5CSVHpn9I77vTDRD2VY+hCW03RQSSqPZI5JR/BhaBW8W3yw2XkmEbXVSHEDuRy58KK+wKvlGoD5qo7UJTxA4wOGckYwj3ZmkI/ZzJBpx6leHpHVE+skPEtBx6dX4z5dGNmRDLiOQVyuaaFnUhDAk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781694450; c=relaxed/simple; bh=0w1s3YLkG+jtkr8qUvyuwkEbPb4RqLlVdDbqa6f/WtY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=lugpKgAKOzpuZ0ypFnMtNdhc40VZNqoOygewN5vC+UXEM+S5PcPCeIy7wKC1HZP0nvkCo2CH3RZRZMGqShtjJNdNFhMEhzZC2KqpAwoquJBCe4sxZOqSMTrY1Ttnz2mT7lnk/fyGpUnuZiD8th3d1jxhpttN1VpiiSFXbmEO4To= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=Fa9eQQyv; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=SdIr35rL; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="Fa9eQQyv"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="SdIr35rL" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65HAoniX2589939 for ; Wed, 17 Jun 2026 11:07:28 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 6y9ccpxsi5yOvGDb95mPzv4201ZnlOndGkxveCSQBy0=; b=Fa9eQQyvT6/fYXwB Ar+yBsfOHuqXmBX4aG8koDP+IythKcL/6cfa7fu3WMrzIInJ9RcM4lKHqD0dLDLI +JL6ZvNuMNUyQhciqAr/rSoGRYY7JebGbS6VKOmEVPk5WnW4FFDL5cjCWd90mmm/ ZkXBfi1ugupurheaOBQQW1THX2em/BBmtq9koxZHCHJdgx0dZRtUOtcPRsBv8FwF edu9Ceccm3HmBnTXjuYd4fCwuKhN15nypCOQ/0hRS1O/UdTGm1N1Hm35E0jUhWX7 wuEzbEZKdW2XqTRqXOwjeibedBVNvfOcZCK9+zlRwuxSrr0e5KhuYy5NEkvUIxhI r5AEVg== Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4euef2auqs-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 17 Jun 2026 11:07:27 +0000 (GMT) Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-36d982d932aso7244467a91.0 for ; Wed, 17 Jun 2026 04:07:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1781694447; x=1782299247; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=6y9ccpxsi5yOvGDb95mPzv4201ZnlOndGkxveCSQBy0=; b=SdIr35rLxMt9RbQLIcY9PpvJ2TYbotzQT5yVXJEBBWJ6ItwG9yHV4nyq8xUVeGbNyY YBmJzmKfYYbNRHeMEIk+mnoem5QdJHiK3yAM02qfXxKi7AMQMk7uwvBh3m0rP51EPnz3 M+p87L1TPJShs5MrMzoLu2cfYjtVs9ub45SP2LCKwTa+QkNVqU2OFE3dwAf92ZH2FCys UzWwvaPxFmc4Nez7SpBnYh+NFoumrIWspA6bzFPP47WdMdPHT+XunkDCYoQg1OGH8jk+ fttPEmSRnrt2rFoyb/9fMBpKkLrXfGt/gDeJjtwfEYWfGJSWOCy95xgorGgiz9URLlaq LplA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781694447; x=1782299247; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=6y9ccpxsi5yOvGDb95mPzv4201ZnlOndGkxveCSQBy0=; b=BhEqiEhydfxTdmFlZJWYxiwba+TQkdJnU7x0D2fBwp0TnPjpArfNWm7zEbRLcguEr7 6BFALTn8PUDQEuv8TzYZ8wqjKZHqeuDssQTANFwsbOR0C3Hy+uvZW/uXvg2gKFP0oAwh CirU+5yutIMtddhToIAOx/Dk9/NRAsYitbXXWW5LIA9lI9tCUS9zO1kVUe4XGDi0IHca b+KQxciBiM38JyTbRRGpaTFFcf6wMgaDm3FdpHOCBALOEstQS4Ne3hsy14uK+DpyrMXo 244ccLve/U5XSinvfoKk15GI6d3gnaOWLNaM35UdtDwFulLx2fL5+354wmqwmfczE0jk Jt9w== X-Forwarded-Encrypted: i=1; AFNElJ849fBt1wtsfLNx2VgUXIWX15o4Eg9lP82EUGZ4eI0HEkwCRvvygYdc89ee/FgXaIv7fGJnEuJZQ6TFBec4ny+x@vger.kernel.org X-Gm-Message-State: AOJu0YxwEeciBO2eMKUWakb96kkmezLIV+v/BajEHua2LC47OPWkn+FI n8rgH5pQOcPb7fARHf9a1Bw3PDzJ68FG/Kw94WB4ElUveT52RLcBFMy43dJcqnh+H//sUnNlCXb r8XIARX2w2ZhOFrNA04y7fG/3O2BVSZW2bgODDgUsvvgfV0f8TgpIXFhMIFZp0QPAl4Q0hyda X-Gm-Gg: AfdE7clPnB3ExoU/Ilo0aMRHH7UFs925Mr8+gtnkQzzLLdXvPMMpnmWY4WLha3b0XSb mQbyZOY1zV/TrRZI5yhoV+vTNDqsMM8/UsJtoGdknGApj8zZz1R6LRfKwLVQJoNkUkUnONOhozN NMW6AZMqAuLE/2dwNnFAs66c7Ti8ztV15j+b5gJ1HTdMQw2hXCg6Zu43iM6c0fe3P7n2Za1Xgh6 +AnDPpdx3ZckqPHtgvrA6cw/qaAHzMfDoKtFhVEZ+3gm3pCghFeHys8OQTDJB4UPNEbEqSuSF6p 0GminqcEL0a8bExupu6gyiXj9JiZ7uvx2AJAEByw9Nmn4BJvsdHrt3QbyL5VPConL15UXdpLTBQ SJ7c0asBi7vaxMrY8C8W3BFGhPwQYe/K0kx7+fqYLfxQ+nsLYVk8d+fjaZQVXDS796rUuewjRhD /CCK/HJA== X-Received: by 2002:a17:90b:5807:b0:36d:ae6a:22f4 with SMTP id 98e67ed59e1d1-37c9e9c8c7emr2943104a91.15.1781694446548; Wed, 17 Jun 2026 04:07:26 -0700 (PDT) X-Received: by 2002:a17:90b:5807:b0:36d:ae6a:22f4 with SMTP id 98e67ed59e1d1-37c9e9c8c7emr2943065a91.15.1781694445993; Wed, 17 Jun 2026 04:07:25 -0700 (PDT) Received: from CHUNKAID2.ap.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-37c5228eb5bsm5577639a91.12.2026.06.17.04.07.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Jun 2026 04:07:25 -0700 (PDT) From: Chunkai Deng Date: Wed, 17 Jun 2026 19:07:14 +0800 Subject: [PATCH v2 2/2] rpmsg: glink: smem: Add WARN_ON_ONCE for FIFO index invariants Precedence: bulk X-Mailing-List: linux-remoteproc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260617-rpmsg-improvements-v2-2-477d4eb569dc@oss.qualcomm.com> References: <20260617-rpmsg-improvements-v2-0-477d4eb569dc@oss.qualcomm.com> In-Reply-To: <20260617-rpmsg-improvements-v2-0-477d4eb569dc@oss.qualcomm.com> To: Bjorn Andersson , Mathieu Poirier Cc: linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-kernel@vger.kernel.org, chris.lew@oss.qualcomm.com, tony.truong@oss.qualcomm.com, Chunkai Deng , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1781694436; l=2286; i=chunkai.deng@oss.qualcomm.com; s=20260512; h=from:subject:message-id; bh=0w1s3YLkG+jtkr8qUvyuwkEbPb4RqLlVdDbqa6f/WtY=; b=WB/PBn5QAVqwzjusrIFk4JTnZj1Sveo89mv10F/gfaxNm4YfnActQH8YKmaaD9fOueq+gIZnq OyweneaLAq7DDrQDG/d0MuzitO8Momdu9vFuncqVhyfApANi7TTYMeG X-Developer-Key: i=chunkai.deng@oss.qualcomm.com; a=ed25519; pk=NfifEElkZxgJ0ghUBxNu1RTaEqtoCGYDb0k5UzIRXOY= X-Authority-Analysis: v=2.4 cv=F8hnsKhN c=1 sm=1 tr=0 ts=6a327fef cx=c_pps a=0uOsjrqzRL749jD1oC5vDA==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=SdC2vBNBQt3qShdCGKMA:9 a=QEXdDO2ut3YA:10 a=mQ_c8vxmzFEMiUWkPHU9:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNjE3MDEwNCBTYWx0ZWRfX522LFJLZInpn RTSj4Wb2qMyEsxuX6X/aUxW+ryJX0ebqe37udFroJY+oNqQTPjB32NtxP7sRvU6nGaJeOmBdeD2 rRbk5ub3kGhbxCiPWMujgMRrPxjKinU= X-Proofpoint-GUID: OyPt_fIP8oEpue81SnlHVr_mzFK4wtAD X-Proofpoint-ORIG-GUID: OyPt_fIP8oEpue81SnlHVr_mzFK4wtAD X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjE3MDEwNCBTYWx0ZWRfX4XrwkmpK341n t5hmnvznUZ82M8FlBfglrLTP+xkmXnUKRMv1WbO33lF8SzI4f68SzFCLFu8HY4UioegVjlbkJ/2 GDLRev4ysTwI+dEz/Ot9zObZtUa7t71e3lEQwke4lcdqYQEZPWHgfjaB5Z7IQsypcB/Uw1lBLpK A9hiLyPNkaWx2GtaNgLL1OcEL+YY3yA9cpd1YRhouSt0Y0yxxn9Uj3m+2wA0xA0rTlXF4OBxRyR YdbRUD0yI4UmhvJGnHV5heco6Y1ygo9EJjgrGpM/Ksa0Ie9OUBE+Zb7kz/HOfHU6NlVrcoa72Ai CoSbVkeQs04e8nYIhdtJ8z8/5UYOZtJu4VNOFL48cbpH8gSvbG+NvyZZhNNOPEhcvINsqIGsCNa +i3WkPkjjAizrioZv2Ypz51g826qge15PYtZQD6Zct6Yh2jELj9qxXG1spmPREgj/gHRbNi+NJ5 i8mMeyGWObGsztKg4XQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-17_01,2026-06-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 bulkscore=0 malwarescore=0 priorityscore=1501 suspectscore=0 lowpriorityscore=0 phishscore=0 adultscore=0 clxscore=1015 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606170104 The FIFO read/write helpers assume the head and tail indices stay within [0, pipe->native.length) and use them directly as offsets into the mapped FIFO region. If that invariant is ever broken, the subsequent memcpy or memcpy_fromio would access memory outside the FIFO. Add WARN_ON_ONCE checks in these helpers so a broken invariant is caught and reported once, and the out-of-bounds access is skipped instead of proceeding silently. Fixes: caf989c350e8 ("rpmsg: glink: Introduce glink smem based transport") Cc: stable@vger.kernel.org Signed-off-by: Chunkai Deng --- drivers/rpmsg/qcom_glink_smem.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c index edab912557ac..42ad315d7910 100644 --- a/drivers/rpmsg/qcom_glink_smem.c +++ b/drivers/rpmsg/qcom_glink_smem.c @@ -86,9 +86,14 @@ static size_t glink_smem_rx_avail(struct qcom_glink_pipe *np) tail = le32_to_cpu(*pipe->tail); if (head < tail) - return pipe->native.length - tail + head; + len = pipe->native.length - tail + head; else - return head - tail; + len = head - tail; + + if (WARN_ON_ONCE(len > pipe->native.length)) + len = 0; + + return len; } static void glink_smem_rx_peek(struct qcom_glink_pipe *np, @@ -103,6 +108,9 @@ static void glink_smem_rx_peek(struct qcom_glink_pipe *np, if (tail >= pipe->native.length) tail -= pipe->native.length; + if (WARN_ON_ONCE(tail >= pipe->native.length)) + return; + len = min_t(size_t, count, pipe->native.length - tail); if (len) memcpy_fromio(data, pipe->fifo + tail, len); @@ -141,6 +149,9 @@ static size_t glink_smem_tx_avail(struct qcom_glink_pipe *np) else avail = tail - head; + if (WARN_ON_ONCE(avail > pipe->native.length)) + avail = 0; + if (avail < (FIFO_FULL_RESERVE + TX_BLOCKED_CMD_RESERVE)) avail = 0; else @@ -155,6 +166,9 @@ static unsigned int glink_smem_tx_write_one(struct glink_smem_pipe *pipe, { size_t len; + if (WARN_ON_ONCE(head >= pipe->native.length)) + return head; + len = min_t(size_t, count, pipe->native.length - head); if (len) memcpy(pipe->fifo + head, data, len); -- 2.34.1