Re: [PATCH] mailbox: mtk-adsp: fix UAF during device teardown

[Tzung-Bi Shih <tzungbi@kernel.org>]

On Tue, Apr 28, 2026 at 11:55:44AM +0900, Sergey Senozhatsky wrote:
> When the SOF audio driver fails to initialize (e.g. firmware boot
> timeout), its devres unwind frees the snd_sof_dev object that the
> mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback.
> The mtk-adsp-mailbox shutdown clears the mailbox command registers
> but leaves the IRQ line unmasked, so a late interrupt can still
> queue a threaded handler after mbox_free_channel() had cleared
> chan->cl, and mbox_chan_received_data() would then trigger UAF:
> 
>   BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version
>    sof_ipc3_validate_fw_version
>    sof_ipc3_do_rx_work
>    sof_ipc3_rx_msg
>    mt8196_dsp_handle_request
>    mtk_adsp_ipc_recv
>    mbox_chan_received_data
>    mtk_adsp_mbox_isr
>    irq_thread_fn
>   Freed by task ...:
>    kfree
>    devres_release_all
>    really_probe
>    ... (sof-audio-of-mt8196 probe failure)
> 
> The crash was observed roughly three seconds after the failed probe.
> 
> disable_irq() in shutdown and enable_irq() in startup. disable_irq()
> also waits for any in-flight interrupts, so by the time
> mbox_free_channel() proceeds to clear chan->cl no rx_callback can run.
> 
> In addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked
> between probe and the first client bind — otherwise an early interrupt
> can crash on chan->cl == NULL in mbox_chan_received_data().
> 
> Fixes: af2dfa96c52d ("mailbox: mediatek: add support for adsp mailbox controller")
> Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>

Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>