Re: [PATCH] firmware: arm_ffa: Compare notify_id when looking up notifier callbacks

[Sudeep Holla <sudeep.holla@kernel.org>]

On Tue, Oct 20, 2026 at 03:09:01PM -0700, David Cemin wrote:
> The notifier callbacks are kept in a hash table keyed by notification ID,
> but struct notifier_cb_info does not store the ID and none of the lookup
> helpers compare it. hash_for_each_possible() walks the whole bucket, so
> any two IDs that hash to the same bucket are treated as the same
> registration.
> 
> With the 64-bucket table, hash_32() maps IDs 2 and 36 to the same
> bucket. A driver that requests notifications sequentially therefore
> fails at the 37th request:
> 
>   ARM FF-A: Failed to register callback for 36 - -22
> 

Nice catch. I dropped the exact same change before posting the support
on the list. For some unknown reason, I assumed there will be no collisions
for such small sized buckets, my bad.

> because update_notifier_cb() finds the node registered for ID 2 and
> rejects the new registration as a duplicate. The same lookup is used on
> the delivery path, so a notification for a colliding ID can also be
> dispatched to the callback registered for the other ID.
> 
> Store the notification ID in the node and compare it in all three
> lookup helpers.
> 
> This was found on an arm64 laptop whose embedded controller partition
> declares 38 notifications: the EC driver failed to probe and every
> EC event (AC, battery, lid, hotkeys) was lost.
> 

I will queue it soon and send it as fix at -rc1 or later.
Thanks for finding and fixing the issue.

> Fixes: e0573444edbf ("firmware: arm_ffa: Add interfaces to request notification callbacks")
> Fixes: c10debfe7f02 ("firmware: arm_ffa: Add support for {un,}registration of framework notifications")

Is this because of rework we have 2 fixes tag. Need to check how backport
would work, hence asking. I will also check before applying.

-- 
Regards,
Sudeep