[PATCH] mfd: macsmc: Hold the lock while reading key info

[PATCH] mfd: macsmc: Hold the lock while reading key info

[Yuvan Shen via B4 Relay]

From: Yuvan Shen <yuvanshen09@gmail.com>

apple_smc_get_key_info() releases the SMC mutex when apple_smc_cmd()
returns, and only then copies the reply out of the shared memory buffer.
A command issued by another thread in between can overwrite the buffer,
so the key's size, type and flags can come from a different reply. The
hwmon and power sub-devices call it from their probe functions, while
the other sub-devices may already be issuing commands.

Hold the mutex until the reply has been copied, as apple_smc_read() and
apple_smc_write() do.

Fixes: e038d985c982 ("mfd: Add Apple Silicon System Management Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Yuvan Shen <yuvanshen09@gmail.com>
---
 drivers/mfd/macsmc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/macsmc.c b/drivers/mfd/macsmc.c
index 514cba7dc897..4dbaacc7eb3d 100644
--- a/drivers/mfd/macsmc.c
+++ b/drivers/mfd/macsmc.c
@@ -210,7 +210,9 @@ int apple_smc_get_key_info(struct apple_smc *smc, smc_key key, struct apple_smc_
 	u8 key_info[6];
 	int ret;
 
-	ret = apple_smc_cmd(smc, SMC_MSG_GET_KEY_INFO, key, 0, 0, NULL);
+	guard(mutex)(&smc->mutex);
+
+	ret = apple_smc_cmd_locked(smc, SMC_MSG_GET_KEY_INFO, key, 0, 0, NULL);
 	if (ret >= 0 && info) {
 		memcpy_fromio(key_info, smc->shmem.iomem, sizeof(key_info));
 		info->size = key_info[0];

---
base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
change-id: 20261101-upstream-macsmc-key-info-714c15af3652

Best regards,
--  
Yuvan Shen <yuvanshen09@gmail.com>