linux-stable.git/drivers/mailbox, branch linux-6.3.y Linux kernel stable tree mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() 2023-06-09T08:48:11+00:00 Dan Carpenter dan.carpenter@linaro.org 2023-05-05T09:22:09+00:00 c51b76e7b5c9a66206ba000f4b971184ee338cee [ Upstream commit 8fe72b76db79d694858e872370df49676bc3be8c ] There was a bug where this code forgot to unlock the tdev->mutex if the kzalloc() failed. Fix this issue, by moving the allocation outside the lock. Fixes: 2d1e952a2b8e ("mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Lee Jones <lee@kernel.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 8fe72b76db79d694858e872370df49676bc3be8c ]

There was a bug where this code forgot to unlock the tdev->mutex if the
kzalloc() failed.  Fix this issue, by moving the allocation outside the
lock.

Fixes: 2d1e952a2b8e ("mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() 2023-06-09T08:47:59+00:00 Lee Jones lee@kernel.org 2023-04-20T07:27:18+00:00 54fb4a623722430e323d1a426e7d65ccac178fab [ Upstream commit 2d1e952a2b8e5e92d8d55ac88a7cf7ca5ea591ad ] If a user can make copy_from_user() fail, there is a potential for UAF/DF due to a lack of locking around the allocation, use and freeing of the data buffers. This issue is not theoretical. I managed to author a POC for it: BUG: KASAN: double-free in kfree+0x5c/0xac Free of addr ffff29280be5de00 by task poc/356 CPU: 1 PID: 356 Comm: poc Not tainted 6.1.0-00001-g961aa6552c04-dirty #20 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x64/0x80 print_report+0x188/0x48c kasan_report_invalid_free+0xa0/0xc0 ____kasan_slab_free+0x174/0x1b0 __kasan_slab_free+0x18/0x24 __kmem_cache_free+0x130/0x2e0 kfree+0x5c/0xac mbox_test_message_write+0x208/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Allocated by task 356: kasan_save_stack+0x3c/0x70 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xc0 kmalloc_trace+0x58/0x70 mbox_test_message_write+0x6c/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Freed by task 357: kasan_save_stack+0x3c/0x70 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c ____kasan_slab_free+0x13c/0x1b0 __kasan_slab_free+0x18/0x24 __kmem_cache_free+0x130/0x2e0 kfree+0x5c/0xac mbox_test_message_write+0x208/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 2d1e952a2b8e5e92d8d55ac88a7cf7ca5ea591ad ]

If a user can make copy_from_user() fail, there is a potential for
UAF/DF due to a lack of locking around the allocation, use and freeing
of the data buffers.

This issue is not theoretical.  I managed to author a POC for it:

    BUG: KASAN: double-free in kfree+0x5c/0xac
    Free of addr ffff29280be5de00 by task poc/356
    CPU: 1 PID: 356 Comm: poc Not tainted 6.1.0-00001-g961aa6552c04-dirty #20
    Hardware name: linux,dummy-virt (DT)
    Call trace:
     dump_backtrace.part.0+0xe0/0xf0
     show_stack+0x18/0x40
     dump_stack_lvl+0x64/0x80
     print_report+0x188/0x48c
     kasan_report_invalid_free+0xa0/0xc0
     ____kasan_slab_free+0x174/0x1b0
     __kasan_slab_free+0x18/0x24
     __kmem_cache_free+0x130/0x2e0
     kfree+0x5c/0xac
     mbox_test_message_write+0x208/0x29c
     full_proxy_write+0x90/0xf0
     vfs_write+0x154/0x440
     ksys_write+0xcc/0x180
     __arm64_sys_write+0x44/0x60
     invoke_syscall+0x60/0x190
     el0_svc_common.constprop.0+0x7c/0x160
     do_el0_svc+0x40/0xf0
     el0_svc+0x2c/0x6c
     el0t_64_sync_handler+0xf4/0x120
     el0t_64_sync+0x18c/0x190

    Allocated by task 356:
     kasan_save_stack+0x3c/0x70
     kasan_set_track+0x2c/0x40
     kasan_save_alloc_info+0x24/0x34
     __kasan_kmalloc+0xb8/0xc0
     kmalloc_trace+0x58/0x70
     mbox_test_message_write+0x6c/0x29c
     full_proxy_write+0x90/0xf0
     vfs_write+0x154/0x440
     ksys_write+0xcc/0x180
     __arm64_sys_write+0x44/0x60
     invoke_syscall+0x60/0x190
     el0_svc_common.constprop.0+0x7c/0x160
     do_el0_svc+0x40/0xf0
     el0_svc+0x2c/0x6c
     el0t_64_sync_handler+0xf4/0x120
     el0t_64_sync+0x18c/0x190

    Freed by task 357:
     kasan_save_stack+0x3c/0x70
     kasan_set_track+0x2c/0x40
     kasan_save_free_info+0x38/0x5c
     ____kasan_slab_free+0x13c/0x1b0
     __kasan_slab_free+0x18/0x24
     __kmem_cache_free+0x130/0x2e0
     kfree+0x5c/0xac
     mbox_test_message_write+0x208/0x29c
     full_proxy_write+0x90/0xf0
     vfs_write+0x154/0x440
     ksys_write+0xcc/0x180
     __arm64_sys_write+0x44/0x60
     invoke_syscall+0x60/0x190
     el0_svc_common.constprop.0+0x7c/0x160
     do_el0_svc+0x40/0xf0
     el0_svc+0x2c/0x6c
     el0t_64_sync_handler+0xf4/0x120
     el0t_64_sync+0x18c/0x190

Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
mailbox: mpfs: switch to txdone_poll 2023-05-11T14:17:04+00:00 Conor Dooley conor.dooley@microchip.com 2023-03-07T20:22:52+00:00 60be03859d544c187f91bf611e68d3b4b029a965 [ Upstream commit b5984a9844fc45cd301a28fb56f3de95f7e20f3c ] The system controller on PolarFire SoC has no interrupt to signify that the TX has been completed. The interrupt instead signals that a service requested by the mailbox client has succeeded. If a service fails, there will be no interrupt delivered. Switch to polling the busy register to determine whether transmission has completed. Fixes: 83d7b1560810 ("mbox: add polarfire soc system controller mailbox") Acked-by: Jassi Brar <jaswinder.singh@linaro.org> Tested-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit b5984a9844fc45cd301a28fb56f3de95f7e20f3c ]

The system controller on PolarFire SoC has no interrupt to signify that
the TX has been completed. The interrupt instead signals that a service
requested by the mailbox client has succeeded. If a service fails, there
will be no interrupt delivered.

Switch to polling the busy register to determine whether transmission
has completed.

Fixes: 83d7b1560810 ("mbox: add polarfire soc system controller mailbox")
Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
Tested-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
mailbox: zynqmp: Fix counts of child nodes 2023-05-11T14:16:55+00:00 Tanmay Shah tanmay.shah@amd.com 2023-03-11T01:24:04+00:00 9ef69f3c49d0222f8e7c8808e5d39a0f354fc2b0 commit f72f805e72882c361e2a612c64a6e549f3da7152 upstream. If child mailbox node status is disabled it causes crash in interrupt handler. Fix this by assigning only available child node during driver probe. Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Tanmay Shah <tanmay.shah@amd.com> Acked-by: Michal Simek <michal.simek@amd.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230311012407.1292118-2-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit f72f805e72882c361e2a612c64a6e549f3da7152 upstream.

If child mailbox node status is disabled it causes
crash in interrupt handler. Fix this by assigning
only available child node during driver probe.

Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
Signed-off-by: Tanmay Shah <tanmay.shah@amd.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230311012407.1292118-2-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mailbox: zynqmp: Fix IPI isr handling 2023-05-11T14:16:55+00:00 Tanmay Shah tanmay.shah@amd.com 2023-03-11T01:24:05+00:00 a3e30441f95876ff033af2b06dc815f9abb02238 commit 74ad37a30ffee3643bc34f9ca7225b20a66abaaf upstream. Multiple IPI channels are mapped to same interrupt handler. Current isr implementation handles only one channel per isr. Fix this behavior by checking isr status bit of all child mailbox nodes. Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Tanmay Shah <tanmay.shah@amd.com> Acked-by: Michal Simek <michal.simek@amd.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230311012407.1292118-3-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 74ad37a30ffee3643bc34f9ca7225b20a66abaaf upstream.

Multiple IPI channels are mapped to same interrupt handler.
Current isr implementation handles only one channel per isr.
Fix this behavior by checking isr status bit of all child
mailbox nodes.

Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
Signed-off-by: Tanmay Shah <tanmay.shah@amd.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230311012407.1292118-3-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mailbox: qcom-apcs-ipc: add IPQ5332 APSS clock support 2023-02-23T20:47:13+00:00 Kathiravan T quic_kathirav@quicinc.com 2023-02-02T14:52:07+00:00 1261a6626a08071b7c9fa3025deb569c91eb55ae IPQ5332 has the APSS clock controller utilizing the same register space as the APCS, so provide access to the APSS utilizing a child device like other IPQ chipsets. Like IPQ6018, the same controller and driver is used, so utilize IPQ6018 match data for IPQ5332. Signed-off-by: Kathiravan T <quic_kathirav@quicinc.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
IPQ5332 has the APSS clock controller utilizing the same register space
as the APCS, so provide access to the APSS utilizing a child device like
other IPQ chipsets.

Like IPQ6018, the same controller and driver is used, so utilize IPQ6018
match data for IPQ5332.

Signed-off-by: Kathiravan T <quic_kathirav@quicinc.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
mailbox: qcom-apcs-ipc: enable APCS clock device for MSM8996 2023-02-23T20:47:12+00:00 Dmitry Baryshkov dmitry.baryshkov@linaro.org 2023-01-26T23:03:18+00:00 adb239f340935b854ce56035fee2035345f9d633 MSM8996 also has the clock-related part of the APCS mailbox device. Follow the usual pattern and create a child device to handle these clocks. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
MSM8996 also has the clock-related part of the APCS mailbox device.
Follow the usual pattern and create a child device to handle these
clocks.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
mailbox: zynq: Switch to flexible array to simplify code 2023-02-23T20:47:12+00:00 Christophe JAILLET christophe.jaillet@wanadoo.fr 2022-11-20T08:25:54+00:00 043f85ce81cb1714e14d31c322c5646513dde3fb Using flexible array is more straight forward. It - saves 1 pointer in the 'zynqmp_ipi_pdata' structure - saves an indirection when using this array - saves some LoC and avoids some always spurious pointer arithmetic Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
Using flexible array is more straight forward. It
  - saves 1 pointer in the 'zynqmp_ipi_pdata' structure
  - saves an indirection when using this array
  - saves some LoC and avoids some always spurious pointer arithmetic

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Merge tag 'mailbox-v6.2' of git://git.linaro.org/landing-teams/working/fujitsu/integration 2022-12-21T17:31:18+00:00 Linus Torvalds torvalds@linux-foundation.org 2022-12-21T17:31:18+00:00 f2855eec19cadddad2900da3a009ee39df6116a7 Pull mailbox updates from Jassi Brar: - qcom: enable sc8280xp, sm8550 and sm4250 support - ti: default to ARCH_K3 for msg manager - mediatek: - add mt8188 and mt8186 support - request irq only after got ready - zynq-ipi: fix error handling after device_register - mpfs: check sys-con status - rockchip: simplify by using device_get_match_data * tag 'mailbox-v6.2' of git://git.linaro.org/landing-teams/working/fujitsu/integration: dt-bindings: mailbox: qcom-ipcc: Add compatible for SM8550 mailbox: mtk-cmdq: Do not request irq until we are ready mailbox: zynq-ipi: fix error handling while device_register() fails mailbox: mtk-cmdq-mailbox: Use platform data directly instead of copying mailbox: arm_mhuv2: Fix return value check in mhuv2_probe() dt-bindings: mailbox: mediatek,gce-mailbox: add mt8188 compatible name dt-bindings: mailbox: add GCE header file for mt8188 mailbox: mpfs: read the system controller's status mailbox: mtk-cmdq: add MT8186 support mailbox: mtk-cmdq: add gce ddr enable support flow mailbox: mtk-cmdq: add gce software ddr enable private data mailbox: mtk-cmdq: Use GCE_CTRL_BY_SW definition instead of number mailbox: rockchip: Use device_get_match_data() to simplify the code dt-bindings: mailbox: qcom-ipcc: Add sc8280xp compatible mailbox: config: ti-msgmgr: Default set to ARCH_K3 for TI msg manager mailbox: qcom-apcs-ipc: Add SM4250 APCS IPC support dt-bindings: mailbox: qcom: Add SM4250 APCS compatible 
Pull mailbox updates from Jassi Brar:

 - qcom: enable sc8280xp, sm8550 and sm4250 support

 - ti: default to ARCH_K3 for msg manager

 - mediatek:
    - add mt8188 and mt8186 support
    - request irq only after got ready

 - zynq-ipi: fix error handling after device_register

 - mpfs: check sys-con status

 - rockchip: simplify by using device_get_match_data

* tag 'mailbox-v6.2' of git://git.linaro.org/landing-teams/working/fujitsu/integration:
  dt-bindings: mailbox: qcom-ipcc: Add compatible for SM8550
  mailbox: mtk-cmdq: Do not request irq until we are ready
  mailbox: zynq-ipi: fix error handling while device_register() fails
  mailbox: mtk-cmdq-mailbox: Use platform data directly instead of copying
  mailbox: arm_mhuv2: Fix return value check in mhuv2_probe()
  dt-bindings: mailbox: mediatek,gce-mailbox: add mt8188 compatible name
  dt-bindings: mailbox: add GCE header file for mt8188
  mailbox: mpfs: read the system controller's status
  mailbox: mtk-cmdq: add MT8186 support
  mailbox: mtk-cmdq: add gce ddr enable support flow
  mailbox: mtk-cmdq: add gce software ddr enable private data
  mailbox: mtk-cmdq: Use GCE_CTRL_BY_SW definition instead of number
  mailbox: rockchip: Use device_get_match_data() to simplify the code
  dt-bindings: mailbox: qcom-ipcc: Add sc8280xp compatible
  mailbox: config: ti-msgmgr: Default set to ARCH_K3 for TI msg manager
  mailbox: qcom-apcs-ipc: Add SM4250 APCS IPC support
  dt-bindings: mailbox: qcom: Add SM4250 APCS compatible
mailbox: mtk-cmdq: Do not request irq until we are ready 2022-12-19T02:40:31+00:00 Ricardo Ribalda ribalda@chromium.org 2022-11-30T12:58:22+00:00 16edcfef77147748c43c9c58ce18f59c61d1c357 If the system comes from kexec() the peripheral might trigger an IRQ befoe we are ready for it. Triggering a crash due to an access to invalid memory. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Chun-Kuang Hu <chunkuang.hu@kernel.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
If the system comes from kexec() the peripheral might trigger an IRQ
befoe we are ready for it. Triggering a crash due to an access to
invalid memory.

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>