Re: [PATCH v5 REPOST] remoteproc: imx_rproc: Invoke the callback directly

Re: [PATCH v5 REPOST] remoteproc: imx_rproc: Invoke the callback directly

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the IDR iteration via `idr_for_each()` in `imx_rproc_rx_callback()` is performed without holding the RCU read lock in a preemptible context, potentially leading to a use-after-free.
- [High] This problem wasn't introduced by this patch, but the mailbox channel is leaked on the `imx_rproc_start` error path, allowing concurrent mailbox callbacks during resource cleanup and causing a Use-After-Free of `rvring`.
--

--- Patch [1]: [PATCH v5 REPOST] remoteproc: imx_rproc: Invoke the callback directly ---
commit 861718f5edd7547335536b279e55e3c8605a7454
Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

remoteproc: imx_rproc: Invoke the callback directly

This commit removes the workqueue handling in the imx_rproc driver and invokes
the imx_rproc_notified_idr_cb callback directly from the mailbox RX callback.
This change is possible because the imx-mailbox driver moved the callback
invocation into the threaded IRQ handler, which runs in a preemptible context.

Link: https://lore.kernel.org/all/20260703-imx_mbox_rproc-v4-1-67b10560a861@linutronix.de/

> diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
> --- a/drivers/remoteproc/imx_rproc.c
> +++ b/drivers/remoteproc/imx_rproc.c

[ ... ]

> @@ -860,21 +857,11 @@ static int imx_rproc_notified_idr_cb(int id, void *ptr, void *data)
>  	return 0;
>  }
>  
> -static void imx_rproc_vq_work(struct work_struct *work)
> -{
> -	struct imx_rproc *priv = container_of(work, struct imx_rproc,
> -					      rproc_work);
> -	struct rproc *rproc = priv->rproc;
> -
> -	idr_for_each(&rproc->notifyids, imx_rproc_notified_idr_cb, rproc);
> -}
> -
>  static void imx_rproc_rx_callback(struct mbox_client *cl, void *msg)
>  {
>  	struct rproc *rproc = dev_get_drvdata(cl->dev);
> -	struct imx_rproc *priv = rproc->priv;
>  
> -	queue_work(priv->workqueue, &priv->rproc_work);
> +	idr_for_each(&rproc->notifyids, imx_rproc_notified_idr_cb, rproc);

[Severity: High]
This isn't a bug introduced by this patch, but since we are now relying
on the threaded IRQ handler's preemptible context instead of the workqueue,
is it safe to call idr_for_each() here without holding the RCU read lock?

According to the IDR API rules, concurrent modifications to the IDR require
readers to hold the RCU read lock. If preemption occurs during this
traversal and a concurrent IDR removal happens (e.g., during driver
teardown), could this allow RCU grace periods to complete prematurely
and result in a use-after-free when dereferencing freed radix tree nodes?

>  }

[ ... ]

Also, while reviewing the driver's mailbox handling, I noticed another
pre-existing issue in a different part of the file:

drivers/remoteproc/imx_rproc.c:imx_rproc_start() {
    ...
    ret = priv->ops->start(rproc);
    if (ret)
        dev_err(dev, "Failed to enable remote core!\n");

    return ret;
}

[Severity: High]
This isn't a bug introduced by this patch, but does the error path in
imx_rproc_start() leak the mailbox channel?

If priv->ops->start(rproc) fails, the function returns an error without
calling imx_rproc_free_mbox(). The remoteproc core then handles the start
failure by skipping rproc->ops->stop() and directly unwinding via
rproc_resource_cleanup(). 

Since this unregisters the virtio devices, causing rvdev to be freed via
devm_kzalloc devres cleanup, could a spurious or delayed interrupt trigger
imx_rproc_rx_callback() concurrently with or after the cleanup? That would
allow the callback to access rproc->notifyids, retrieve the freed rvring,
and dereference it, leading to a use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721-imx_mbox_rproc-v5-1-6386a2cf8524@linutronix.de?part=1