Re: [PATCH] mailbox: pcc: Synchronize channel IRQ before unmapping shared memory

[Sudeep Holla <sudeep.holla@kernel.org>]

On Fri, Aug 28, 2026 at 05:10:33PM +0100, Christian Loehle wrote:
> pcc_mbox_free_channel() unmaps the PCC shared-memory region before
> mbox_free_channel() invokes the controller shutdown callback. For
> interrupt-capable extended subspaces, an in-flight handler may
> consequently access the mapping after it has been invalidated.
> 
> Release the mailbox channel first so its IRQ is disabled and synchronized
> before unmapping the shared-memory region. Serialize PCC channel
> acquisition and release across this sequence: once mbox_free_channel()
> makes the channel available, another client must not replace the
> shared-memory mapping until the old one has been unmapped.
> 

Breno Leitao has already posted the fix for the unmapping before freeing
the channel. You just need the mutex guards.

> Fixes: 7f9e19f207be ("mailbox: pcc: Check before sending MCTP PCC response ACK")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Loehle <christian.loehle@arm.com>
> ---
>  drivers/mailbox/pcc.c | 26 +++++++++++++++++++++-----
>  1 file changed, 21 insertions(+), 5 deletions(-)
> 

I believe after Breno's patch, it can be as simple as below:

Regards,
Sudeep

-->8

diff --git i/drivers/mailbox/pcc.c w/drivers/mailbox/pcc.c
index 9888dab64639..e5e8caa54cf2 100644
--- i/drivers/mailbox/pcc.c
+++ w/drivers/mailbox/pcc.c
@@ -53,6 +53,7 @@
 #include <linux/interrupt.h>
 #include <linux/list.h>
 #include <linux/log2.h>
+#include <linux/mutex.h>
 #include <linux/platform_device.h>
 #include <linux/mailbox_controller.h>
 #include <linux/mailbox_client.h>
@@ -113,6 +114,7 @@ struct pcc_chan_info {
 #define to_pcc_chan_info(c) container_of(c, struct pcc_chan_info, chan)
 static struct pcc_chan_info *chan_info;
 static int pcc_chan_count;
+static DEFINE_MUTEX(pcc_chan_mutex);

 /*
  * PCC can be used with perf critical drivers such as CPPC
@@ -392,6 +394,8 @@ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id)
 	if (subspace_id < 0 || subspace_id >= pcc_chan_count)
 		return ERR_PTR(-ENOENT);

+	guard(mutex)(&pcc_chan_mutex);
+
 	pchan = chan_info + subspace_id;
 	chan = pchan->chan.mchan;
 	if (IS_ERR(chan) || chan->cl) {
@@ -434,6 +438,8 @@ void pcc_mbox_free_channel(struct pcc_mbox_chan *pchan)
 	struct pcc_chan_info *pchan_info;
 	struct pcc_mbox_chan *pcc_mbox_chan;

+	guard(mutex)(&pcc_chan_mutex);
+
 	if (!chan || !chan->cl)
 		return;
 	pchan_info = chan->con_priv;