* [PATCH v3 1/2] rpmsg: glink: smem: Use device name as IRQ name
2026-07-20 13:25 [PATCH v3 0/2] rpmsg: glink: smem: robustness and debuggability fixes Chunkai Deng
@ 2026-07-20 13:25 ` Chunkai Deng
2026-07-20 14:00 ` Konrad Dybcio
2026-07-20 13:25 ` [PATCH v3 2/2] rpmsg: glink: smem: Validate FIFO indices before use Chunkai Deng
1 sibling, 1 reply; 4+ messages in thread
From: Chunkai Deng @ 2026-07-20 13:25 UTC (permalink / raw)
To: Bjorn Andersson, Mathieu Poirier
Cc: linux-arm-msm, linux-remoteproc, linux-kernel, chris.lew,
tony.truong, dmitry.baryshkov, Chunkai Deng
A SoC typically has multiple remoteprocs (ADSP, MPSS, CDSP, etc.), each
registering its own SMEM GLINK instance. With the static name "glink-smem"
all instances appear identically in /proc/interrupts, making it impossible
to associate an IRQ with a specific remote processor.
Pass dev_name(&smem->dev) to devm_request_irq() instead. The device name
is already set to "<parent>:<edge-node>" which uniquely identifies each
instance without requiring an additional field in the driver struct.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Chunkai Deng <chunkai.deng@oss.qualcomm.com>
---
drivers/rpmsg/qcom_glink_smem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c
index 62adc4db2317..edab912557ac 100644
--- a/drivers/rpmsg/qcom_glink_smem.c
+++ b/drivers/rpmsg/qcom_glink_smem.c
@@ -307,7 +307,7 @@ struct qcom_glink_smem *qcom_glink_smem_register(struct device *parent,
smem->irq = of_irq_get(smem->dev.of_node, 0);
ret = devm_request_irq(&smem->dev, smem->irq, qcom_glink_smem_intr,
IRQF_NO_SUSPEND | IRQF_NO_AUTOEN,
- "glink-smem", smem);
+ dev_name(&smem->dev), smem);
if (ret) {
dev_err(&smem->dev, "failed to request IRQ\n");
goto err_put_dev;
--
2.34.1
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH v3 2/2] rpmsg: glink: smem: Validate FIFO indices before use
2026-07-20 13:25 [PATCH v3 0/2] rpmsg: glink: smem: robustness and debuggability fixes Chunkai Deng
2026-07-20 13:25 ` [PATCH v3 1/2] rpmsg: glink: smem: Use device name as IRQ name Chunkai Deng
@ 2026-07-20 13:25 ` Chunkai Deng
1 sibling, 0 replies; 4+ messages in thread
From: Chunkai Deng @ 2026-07-20 13:25 UTC (permalink / raw)
To: Bjorn Andersson, Mathieu Poirier
Cc: linux-arm-msm, linux-remoteproc, linux-kernel, chris.lew,
tony.truong, dmitry.baryshkov, Chunkai Deng, stable
The FIFO read/write helpers assume the head and tail indices stay within
[0, pipe->native.length) and use them directly as offsets into the
mapped FIFO region. If that invariant is ever broken, the subsequent
memcpy or memcpy_fromio would access memory outside the FIFO.
Validate the raw head and tail values (and, where applicable, the
caller-supplied offset/count) against pipe->native.length in the
avail/peek/write helpers. Checking the derived length or the
post-normalized index is not sufficient: two out-of-range indices can
still produce an in-range difference, and reducing a bad index modulo
the FIFO length hides the original invariant violation.
Fixes: caf989c350e8 ("rpmsg: glink: Introduce glink smem based transport")
Cc: stable@vger.kernel.org
Signed-off-by: Chunkai Deng <chunkai.deng@oss.qualcomm.com>
---
drivers/rpmsg/qcom_glink_smem.c | 39 +++++++++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c
index edab912557ac..df3081855b02 100644
--- a/drivers/rpmsg/qcom_glink_smem.c
+++ b/drivers/rpmsg/qcom_glink_smem.c
@@ -85,6 +85,22 @@ static size_t glink_smem_rx_avail(struct qcom_glink_pipe *np)
head = le32_to_cpu(*pipe->head);
tail = le32_to_cpu(*pipe->tail);
+ /*
+ * head is written by the remote peer via SMEM; tail is written
+ * locally. Check the raw values, not a derived length: two
+ * out-of-range indices can still produce an in-range difference,
+ * and reducing a bad index modulo the FIFO length would hide the
+ * invariant violation.
+ */
+ if (unlikely(head >= pipe->native.length)) {
+ dev_warn_ratelimited(&smem->dev,
+ "rx head out of range: head=%u length=%zu\n",
+ head, pipe->native.length);
+ return 0;
+ }
+ if (WARN_ON_ONCE(tail >= pipe->native.length))
+ return 0;
+
if (head < tail)
return pipe->native.length - tail + head;
else
@@ -99,6 +115,11 @@ static void glink_smem_rx_peek(struct qcom_glink_pipe *np,
u32 tail;
tail = le32_to_cpu(*pipe->tail);
+ if (WARN_ON_ONCE(tail >= pipe->native.length))
+ return;
+ if (WARN_ON_ONCE(offset + count > pipe->native.length))
+ return;
+
tail += offset;
if (tail >= pipe->native.length)
tail -= pipe->native.length;
@@ -129,6 +150,7 @@ static void glink_smem_rx_advance(struct qcom_glink_pipe *np,
static size_t glink_smem_tx_avail(struct qcom_glink_pipe *np)
{
struct glink_smem_pipe *pipe = to_smem_pipe(np);
+ struct qcom_glink_smem *smem = pipe->smem;
u32 head;
u32 tail;
u32 avail;
@@ -136,6 +158,19 @@ static size_t glink_smem_tx_avail(struct qcom_glink_pipe *np)
head = le32_to_cpu(*pipe->head);
tail = le32_to_cpu(*pipe->tail);
+ /*
+ * head is written locally; tail is written by the remote peer via
+ * SMEM. Check the raw values, not a derived length.
+ */
+ if (WARN_ON_ONCE(head >= pipe->native.length))
+ return 0;
+ if (unlikely(tail >= pipe->native.length)) {
+ dev_warn_ratelimited(&smem->dev,
+ "tx tail out of range: tail=%u length=%zu\n",
+ tail, pipe->native.length);
+ return 0;
+ }
+
if (tail <= head)
avail = pipe->native.length - head + tail;
else
@@ -177,6 +212,10 @@ static void glink_smem_tx_write(struct qcom_glink_pipe *glink_pipe,
unsigned int head;
head = le32_to_cpu(*pipe->head);
+ if (WARN_ON_ONCE(head >= pipe->native.length))
+ return;
+ if (WARN_ON_ONCE(hlen + dlen > pipe->native.length))
+ return;
head = glink_smem_tx_write_one(pipe, head, hdr, hlen);
head = glink_smem_tx_write_one(pipe, head, data, dlen);
--
2.34.1
^ permalink raw reply [flat|nested] 4+ messages in thread