linux-stable.git/drivers/mailbox, branch v6.5.2 Linux kernel stable tree mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 2023-06-30T22:35:45+00:00 Nishanth Menon nm@ti.com 2023-06-21T01:00:22+00:00 1b712f18c461bd75f018033a15cf381e712806b5 Sec proxy/message manager data buffer is 60 bytes with the last of the registers indicating transmission completion. This however poses a bit of a challenge. The backing memory for sec_proxy / message manager is regular memory, and all sec proxy does is to trigger a burst of all 60 bytes of data over to the target thread backing ring accelerator. It doesn't do a memory scrub when it moves data out in the burst. When we transmit multiple messages, remnants of previous message is also transmitted which results in some random data being set in TISCI fields of messages that have been expanded forward. The entire concept of backward compatibility hinges on the fact that the unused message fields remain 0x0 allowing for 0x0 value to be specially considered when backward compatibility of message extension is done. So, instead of just writing the completion register, we continue to fill the message buffer up with 0x0 (note: for partial message involving completion, we already do this). This allows us to scale and introduce ABI changes back also work with other boot stages that may have left data in the internal memory. While at this, be consistent and explicit with the data_reg pointer increment. Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver") Signed-off-by: Nishanth Menon <nm@ti.com> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
Sec proxy/message manager data buffer is 60 bytes with the last of the
registers indicating transmission completion. This however poses a bit
of a challenge.

The backing memory for sec_proxy / message manager is regular memory,
and all sec proxy does is to trigger a burst of all 60 bytes of data
over to the target thread backing ring accelerator. It doesn't do a
memory scrub when it moves data out in the burst. When we transmit
multiple messages, remnants of previous message is also transmitted
which results in some random data being set in TISCI fields of
messages that have been expanded forward.

The entire concept of backward compatibility hinges on the fact that
the unused message fields remain 0x0 allowing for 0x0 value to be
specially considered when backward compatibility of message extension
is done.

So, instead of just writing the completion register, we continue
to fill the message buffer up with 0x0 (note: for partial message
involving completion, we already do this).

This allows us to scale and introduce ABI changes back also work with
other boot stages that may have left data in the internal memory.

While at this, be consistent and explicit with the data_reg pointer
increment.

Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver")
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
mailbox: tegra: add support for Tegra264 2023-06-30T22:35:45+00:00 Stefan Kristiansson stefank@nvidia.com 2023-05-29T13:50:45+00:00 602dbbacc3ef9b0a8102202bbde9a5f253677cf0 Tegra264 has a slightly different doorbell register layout than previous chips. Acked-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Stefan Kristiansson <stefank@nvidia.com> Signed-off-by: Peter De Schrijver <pdeschrijver@nvidia.com> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
Tegra264 has a slightly different doorbell register layout than
previous chips.

Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Stefan Kristiansson <stefank@nvidia.com>
Signed-off-by: Peter De Schrijver <pdeschrijver@nvidia.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() 2023-05-31T18:26:44+00:00 Dan Carpenter dan.carpenter@linaro.org 2023-05-05T09:22:09+00:00 8fe72b76db79d694858e872370df49676bc3be8c There was a bug where this code forgot to unlock the tdev->mutex if the kzalloc() failed. Fix this issue, by moving the allocation outside the lock. Fixes: 2d1e952a2b8e ("mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Lee Jones <lee@kernel.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
There was a bug where this code forgot to unlock the tdev->mutex if the
kzalloc() failed.  Fix this issue, by moving the allocation outside the
lock.

Fixes: 2d1e952a2b8e ("mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Merge tag 'mailbox-v6.4' of git://git.linaro.org/landing-teams/working/fujitsu/integration 2023-05-07T17:17:33+00:00 Linus Torvalds torvalds@linux-foundation.org 2023-05-07T17:17:33+00:00 1c1094e47ef10be267a982fb1c69dbb80aa4f257 Pull mailbox updates from Jassi Brar: - mailbox api: allow direct registration to a channel and convert omap and pcc to use mbox_bind_client - omap and hi6220 : use of_property_read_bool - test: fix double-free and use spinlock header - rockchip and bcm-pdc: drop of_match_ptr - mpfs: change config symbol - mediatek gce: support MT6795 - qcom apcs: consolidate of_device_id and support IPQ9574 * tag 'mailbox-v6.4' of git://git.linaro.org/landing-teams/working/fujitsu/integration: dt-bindings: mailbox: qcom: add compatible for IPQ9574 SoC mailbox: qcom-apcs-ipc: do not grow the of_device_id dt-bindings: mailbox: qcom,apcs-kpss-global: use fallbacks for few variants dt-bindings: mailbox: mediatek,gce-mailbox: Add support for MT6795 mailbox: mpfs: convert SOC_MICROCHIP_POLARFIRE to ARCH_MICROCHIP_POLARFIRE mailbox: bcm-pdc: drop of_match_ptr for ID table mailbox: rockchip: drop of_match_ptr for ID table mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() mailbox: mailbox-test: Explicitly include header for spinlock support mailbox: Use of_property_read_bool() for boolean properties mailbox: pcc: Use mbox_bind_client mailbox: omap: Use mbox_bind_client mailbox: Allow direct registration to a channel 
Pull mailbox updates from Jassi Brar:

 - mailbox api: allow direct registration to a channel and convert omap
   and pcc to use mbox_bind_client

 - omap and hi6220 : use of_property_read_bool

 - test: fix double-free and use spinlock header

 - rockchip and bcm-pdc: drop of_match_ptr

 - mpfs: change config symbol

 - mediatek gce: support MT6795

 - qcom apcs: consolidate of_device_id and support IPQ9574

* tag 'mailbox-v6.4' of git://git.linaro.org/landing-teams/working/fujitsu/integration:
  dt-bindings: mailbox: qcom: add compatible for IPQ9574 SoC
  mailbox: qcom-apcs-ipc: do not grow the of_device_id
  dt-bindings: mailbox: qcom,apcs-kpss-global: use fallbacks for few variants
  dt-bindings: mailbox: mediatek,gce-mailbox: Add support for MT6795
  mailbox: mpfs: convert SOC_MICROCHIP_POLARFIRE to ARCH_MICROCHIP_POLARFIRE
  mailbox: bcm-pdc: drop of_match_ptr for ID table
  mailbox: rockchip: drop of_match_ptr for ID table
  mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
  mailbox: mailbox-test: Explicitly include header for spinlock support
  mailbox: Use of_property_read_bool() for boolean properties
  mailbox: pcc: Use mbox_bind_client
  mailbox: omap: Use mbox_bind_client
  mailbox: Allow direct registration to a channel
mailbox: qcom-apcs-ipc: do not grow the of_device_id 2023-05-04T05:59:56+00:00 Krzysztof Kozlowski krzysztof.kozlowski@linaro.org 2023-03-27T14:07:49+00:00 e17225887005f5cc6f18cb0fe9519849856b01b5 Re-organize the compatible devices and add a comment to avoid unneeded of_device_id growth with every new SoC. These devices have quite a lot of similarities and they can use only one compatible fallback for driver binding. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
Re-organize the compatible devices and add a comment to avoid unneeded
of_device_id growth with every new SoC.  These devices have quite a lot
of similarities and they can use only one compatible fallback for driver
binding.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
mailbox: mpfs: convert SOC_MICROCHIP_POLARFIRE to ARCH_MICROCHIP_POLARFIRE 2023-05-04T05:53:39+00:00 Conor Dooley conor.dooley@microchip.com 2023-03-09T20:44:50+00:00 5f84a056cf437c4ee5f7ca5bc6928cc56ea5206c As part of converting RISC-V SOC_FOO symbols to ARCH_FOO to match the use of such symbols on other architectures, convert the Microchip FPGA mailbox driver to use the new symbol. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
As part of converting RISC-V SOC_FOO symbols to ARCH_FOO to match the
use of such symbols on other architectures, convert the Microchip FPGA
mailbox driver to use the new symbol.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
mailbox: bcm-pdc: drop of_match_ptr for ID table 2023-05-04T05:53:34+00:00 Krzysztof Kozlowski krzysztof.kozlowski@linaro.org 2023-03-11T11:17:39+00:00 e2aa7993115cfab8a1e6efa7cae05b6817ea69be The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it might not be relevant here). drivers/mailbox/bcm-pdc-mailbox.c:1474:34: error: ‘pdc_mbox_of_match’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
The driver can match only via the DT table so the table should be always
used and the of_match_ptr does not have any sense (this also allows ACPI
matching via PRP0001, even though it might not be relevant here).

  drivers/mailbox/bcm-pdc-mailbox.c:1474:34: error: ‘pdc_mbox_of_match’ defined but not used [-Werror=unused-const-variable=]

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
mailbox: rockchip: drop of_match_ptr for ID table 2023-05-04T05:53:32+00:00 Krzysztof Kozlowski krzysztof.kozlowski@linaro.org 2023-03-11T11:17:38+00:00 7490b8fb98848df2e7ac5c4a0fc2e898146695d1 The driver can match only via the DT table so the table should be always used and the of_match_ptr does not have any sense (this also allows ACPI matching via PRP0001, even though it might not be relevant here). drivers/mailbox/rockchip-mailbox.c:158:34: error: ‘rockchip_mbox_of_match’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
The driver can match only via the DT table so the table should be always
used and the of_match_ptr does not have any sense (this also allows ACPI
matching via PRP0001, even though it might not be relevant here).

  drivers/mailbox/rockchip-mailbox.c:158:34: error: ‘rockchip_mbox_of_match’ defined but not used [-Werror=unused-const-variable=]

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() 2023-05-04T05:53:31+00:00 Lee Jones lee@kernel.org 2023-04-20T07:27:18+00:00 2d1e952a2b8e5e92d8d55ac88a7cf7ca5ea591ad If a user can make copy_from_user() fail, there is a potential for UAF/DF due to a lack of locking around the allocation, use and freeing of the data buffers. This issue is not theoretical. I managed to author a POC for it: BUG: KASAN: double-free in kfree+0x5c/0xac Free of addr ffff29280be5de00 by task poc/356 CPU: 1 PID: 356 Comm: poc Not tainted 6.1.0-00001-g961aa6552c04-dirty #20 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x64/0x80 print_report+0x188/0x48c kasan_report_invalid_free+0xa0/0xc0 ____kasan_slab_free+0x174/0x1b0 __kasan_slab_free+0x18/0x24 __kmem_cache_free+0x130/0x2e0 kfree+0x5c/0xac mbox_test_message_write+0x208/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Allocated by task 356: kasan_save_stack+0x3c/0x70 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xc0 kmalloc_trace+0x58/0x70 mbox_test_message_write+0x6c/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Freed by task 357: kasan_save_stack+0x3c/0x70 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c ____kasan_slab_free+0x13c/0x1b0 __kasan_slab_free+0x18/0x24 __kmem_cache_free+0x130/0x2e0 kfree+0x5c/0xac mbox_test_message_write+0x208/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
If a user can make copy_from_user() fail, there is a potential for
UAF/DF due to a lack of locking around the allocation, use and freeing
of the data buffers.

This issue is not theoretical.  I managed to author a POC for it:

    BUG: KASAN: double-free in kfree+0x5c/0xac
    Free of addr ffff29280be5de00 by task poc/356
    CPU: 1 PID: 356 Comm: poc Not tainted 6.1.0-00001-g961aa6552c04-dirty #20
    Hardware name: linux,dummy-virt (DT)
    Call trace:
     dump_backtrace.part.0+0xe0/0xf0
     show_stack+0x18/0x40
     dump_stack_lvl+0x64/0x80
     print_report+0x188/0x48c
     kasan_report_invalid_free+0xa0/0xc0
     ____kasan_slab_free+0x174/0x1b0
     __kasan_slab_free+0x18/0x24
     __kmem_cache_free+0x130/0x2e0
     kfree+0x5c/0xac
     mbox_test_message_write+0x208/0x29c
     full_proxy_write+0x90/0xf0
     vfs_write+0x154/0x440
     ksys_write+0xcc/0x180
     __arm64_sys_write+0x44/0x60
     invoke_syscall+0x60/0x190
     el0_svc_common.constprop.0+0x7c/0x160
     do_el0_svc+0x40/0xf0
     el0_svc+0x2c/0x6c
     el0t_64_sync_handler+0xf4/0x120
     el0t_64_sync+0x18c/0x190

    Allocated by task 356:
     kasan_save_stack+0x3c/0x70
     kasan_set_track+0x2c/0x40
     kasan_save_alloc_info+0x24/0x34
     __kasan_kmalloc+0xb8/0xc0
     kmalloc_trace+0x58/0x70
     mbox_test_message_write+0x6c/0x29c
     full_proxy_write+0x90/0xf0
     vfs_write+0x154/0x440
     ksys_write+0xcc/0x180
     __arm64_sys_write+0x44/0x60
     invoke_syscall+0x60/0x190
     el0_svc_common.constprop.0+0x7c/0x160
     do_el0_svc+0x40/0xf0
     el0_svc+0x2c/0x6c
     el0t_64_sync_handler+0xf4/0x120
     el0t_64_sync+0x18c/0x190

    Freed by task 357:
     kasan_save_stack+0x3c/0x70
     kasan_set_track+0x2c/0x40
     kasan_save_free_info+0x38/0x5c
     ____kasan_slab_free+0x13c/0x1b0
     __kasan_slab_free+0x18/0x24
     __kmem_cache_free+0x130/0x2e0
     kfree+0x5c/0xac
     mbox_test_message_write+0x208/0x29c
     full_proxy_write+0x90/0xf0
     vfs_write+0x154/0x440
     ksys_write+0xcc/0x180
     __arm64_sys_write+0x44/0x60
     invoke_syscall+0x60/0x190
     el0_svc_common.constprop.0+0x7c/0x160
     do_el0_svc+0x40/0xf0
     el0_svc+0x2c/0x6c
     el0t_64_sync_handler+0xf4/0x120
     el0t_64_sync+0x18c/0x190

Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
mailbox: mailbox-test: Explicitly include header for spinlock support 2023-05-04T05:53:28+00:00 Lee Jones lee@kernel.org 2023-04-20T07:27:17+00:00 be884585852e7d8336e765504399972b3034a89f Presently the support appears to be implied. Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> 
Presently the support appears to be implied.

Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>