From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D4F6B3672AA for ; Tue, 30 Jun 2026 09:50:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782813038; cv=none; b=goAPNpxpjakbTv7ClLWiud1Bw4ykRWTGwZwth1n7qNExjsRj7AIbFR+cT8kQ79lFaQZlqTvO3tnXb+edwIZTWwbliYLqebKvy8ffr8LI7hTfcGIcZqgegSNNZgE5dFh9oqIX4HczFsnKAsWutDQwCsUCsddF3ucdUhvBnahalPE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782813038; c=relaxed/simple; bh=zeZORPZ4UojQer9WR72uC+r8AHCUtBnWOWagKiIJp6s=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=erqa4XVFM6DMzQhSbbpRaOkcn9sGInGxhQKlsksn9+pG+RYSFbqse/JHNdLfGdwcyaGl9SS0ko6lPpPz7p526V3J0tJ1BODyPUYfQnbiBD8DnYcpQG47DoOaobf3m9BWHJ1cFvOn7r4+EkX3YOLNXZaVug4I7vGfkAHEdWEvGtA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=mQ7uUYw5; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=dQve/GiU; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="mQ7uUYw5"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="dQve/GiU" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65U9mxDJ1613433 for ; Tue, 30 Jun 2026 09:50:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= HNb9XBYFqILWYAyDEURGEbUfsIr6u9r9oUv6jsYEpdw=; b=mQ7uUYw5l9oK5D+j JMJOBN0Oi//f9hjaNC1qgB9w7dYgvH2SIpx4jXbqnzUH70xoJpVI7STvaQsbiCu0 BizWfIDaAwPANyRCi7uqS7LP5vVWBB8G7sWS7Ei4DrEJ86ocPW20Tawe9yWCcxGc 3VlecgwYrmUjXZWSDEiAK9WkC94A3hD9zrE1DOZReSGvUuopljmGuo/7cj6cJlLD Ksv9AadQMoO4Fimbwirye4Xk6T1RPmNSvRHAvUFTYc5UuNTzb2kvDqaVClMOXVN9 J98Jj17rTFDJryR0Sav+/c0NFeocQT+XQ3/bC+ezyMpqoyKrlEGGTZfsgBjMDJNx 1auoEg== Received: from mail-qt1-f200.google.com (mail-qt1-f200.google.com [209.85.160.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4f3x1cu5e7-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 30 Jun 2026 09:50:35 +0000 (GMT) Received: by mail-qt1-f200.google.com with SMTP id d75a77b69052e-51c069f73e4so3127591cf.1 for ; Tue, 30 Jun 2026 02:50:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1782813035; x=1783417835; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to :content-type; bh=HNb9XBYFqILWYAyDEURGEbUfsIr6u9r9oUv6jsYEpdw=; b=dQve/GiUexfOMoSo/WSTZwtQCrRJbk6/MRiyAkG9svgJea2LTdOAO3GlHZff3FvGeq Vlp+KGP06H92rENN1x0WfsRrhRJvUoW3kh7RC0JZYiQoL3s79xlrZ1e1cA+vNr0F3kgF oWot0n+7GVrAtuNiTFtJmldcU+RBgN3WD9Lzz+OUfZr105LxQbBNSyQn1rMeKE4eQa5v sDWRpBzSlXWww21trymvaHWUr9lDW5A/C4LhGJhoNgz42WbmH2mUQqHJEco5e2nKNw1j exMbj2vH5SaJZoOBHkJyEonP+oqDaTiFLZXvkYEmBcNabd69VU2zRVjdjKziQ7oqMb6w 9ctQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782813035; x=1783417835; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HNb9XBYFqILWYAyDEURGEbUfsIr6u9r9oUv6jsYEpdw=; b=XNbRrP1J5EbCgbIxJfVM0duAcFL0TD9++qxRUJXGvYXzaq4Cqg6esDyM+lEYEqBbz6 RzO/SclewjDi0gxYKJQzsTbMCvP1kuSAI1gzjnj2W8buENkuE5d9Z1zspX/zp4BaEy+y k7WD/QcJ9oVxaHP1sIi8+iYL+bKKKXdLZjuWUuhIH+g90lUrfUcNR2emCEuXMm4pasSl yvQU2OW5bj2O9JinV6Wc7XMosYzUiv4wh+6ZOYb9FsO+R/+Zp8hmAUO2JoTQIuPQYKLz hwTC03vABMIcsbd80WybJgDtdy74Ebu+1ZxtcUVxg1pGLt3roYvrCwZk7fxT4dNEAPaS 6rNw== X-Forwarded-Encrypted: i=1; AFNElJ9Z8J48QWOUQaeyetwaip27D6oMHLej9khpThRes0a3Ranmi8lCVCEfVRybAbWCOJuawYETKf33/17JtHE=@vger.kernel.org X-Gm-Message-State: AOJu0YxaQk1+DvTFLZZUIUIktl1UfY1iZjw5H7WRCEqOGLzGjl+8PX64 OBQ2w5PaEPOxjp0yMg8gZxsdJ6+LzZig3v0WJ+ado7os5FRjWya8UzXK620sC7N6UKFHQqEguoj A/NXmSDxzdDiwcG1NQxyo8Ql1fjN7AYyzdRSfrr1TunbhQtBD75RxCMfXucyFCP6CJoE= X-Gm-Gg: AfdE7cmRwfcdICmkfBLZF1HwNMGlIq+Mn1tLM7GcDVMmCiupGljPLSl0uhB65Gx4H3x 0BrtIhB+C54UlFbOuDSq9L4oM5DF6uXarxZMdLMhsDGtIj1SGHMKmms7XUSkP434Sg1GZcQjjVJ AdBTgGjAZXD+1DINWgOqhZlBswggUyrUh9L7axyXhN56GAHCP/0ozI9fIUyCuE3qs2DqefFP5dL IA+NncxegoufuAyawU83djIykVfrTRWb7btRmL9e5osA36qJ4KCWJOl5zENIzVz/n6+7oNoKieJ CkjfpRyCnQjhb1wsoJcLcQ7r0euZ7NUfkxKLPoCu/TmjrVWggn/JRVKL/dQd6O7Avssra6rYVFf XrD+hQtoVsYYAziFMg+SZk7lA++DLK7rAH1Q= X-Received: by 2002:a05:622a:134b:b0:51a:8c9b:64a7 with SMTP id d75a77b69052e-51c10950a04mr22323961cf.11.1782813034999; Tue, 30 Jun 2026 02:50:34 -0700 (PDT) X-Received: by 2002:a05:622a:134b:b0:51a:8c9b:64a7 with SMTP id d75a77b69052e-51c10950a04mr22323741cf.11.1782813034523; Tue, 30 Jun 2026 02:50:34 -0700 (PDT) Received: from [192.168.120.170] ([178.235.128.140]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1288f0cb71sm95166366b.39.2026.06.30.02.50.31 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 30 Jun 2026 02:50:33 -0700 (PDT) Message-ID: <6f8e6b61-a6cd-490f-84d8-9ddb8638d952@oss.qualcomm.com> Date: Tue, 30 Jun 2026 11:50:30 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 1/3] firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published To: Mukesh Ojha , Bjorn Andersson , Konrad Dybcio , Bartosz Golaszewski , Guru Das Srinagesh , Sibi Sankar , Elliot Berman , Andrew Halaney Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260629141750.996853-1-mukesh.ojha@oss.qualcomm.com> <20260629141750.996853-2-mukesh.ojha@oss.qualcomm.com> Content-Language: en-US From: Konrad Dybcio In-Reply-To: <20260629141750.996853-2-mukesh.ojha@oss.qualcomm.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjMwMDA4OCBTYWx0ZWRfXx5W1kD7N8qxu OCLSPOttMKKm1cEfPpx1otDN5aTLfNZFBtk00ow+ni3Uv3KEKJHDFSeDA8OfHbixZGuSVQtYK+r flIemaNVDg2SaIUttdBJz0O36tvxTdQbKndtsKG0aMqeTfSccqILPfQJmPpPqPS/DC6Pyp2M87U SKVXDWnJZXUM1bXVAfajktYTtd3ZMx801JpdCfvoc0BpWzyosws6fLTh2007MAi9L/VUt8pjtVP nnZbZerHVY/Q+6nMK8g7QP7RXndsKLIZpWAdXLLdQhqn8OEeqLnWVbIbu4UgdF20r8x9fx/w8ur TqKsRRpJmkTxHIAsi8ADV2u7rMni+2aZCSZ9mctDqHdq/uixuKW+eM32C8rlODPzOKW8T4GKvxw KoAi339YbcLXLE/S68hTtPvUds8C1fuugR2E/JHgdKq7tzq3RtylRM24cOtBN34Flyrlcb1+xTm Tqe8dzDR00nPhvs+hpw== X-Proofpoint-ORIG-GUID: m0JxHl1BynzrWowd4BcXnvitepfw6q1T X-Proofpoint-GUID: m0JxHl1BynzrWowd4BcXnvitepfw6q1T X-Authority-Analysis: v=2.4 cv=ftfsol4f c=1 sm=1 tr=0 ts=6a43916b cx=c_pps a=JbAStetqSzwMeJznSMzCyw==:117 a=PRfkaYvzSr8QmIIGAkY2Sg==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=EUspDBNiAAAA:8 a=FCaoNH41jgI7cho72MMA:9 a=QEXdDO2ut3YA:10 a=uxP6HrT_eTzRwkO_Te1X:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNjMwMDA4OCBTYWx0ZWRfX9RXR9IAZazEW sD/vFqtu+47RRvZLxRJ5vaWUEf/uki2XWOKGTWTq074BRDAulAOMqMZyhyyuGbwQoVUnCUvPSif DbnDrJrlwl4ajKG60aSWZTiw8LQlwis= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-30_03,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 adultscore=0 spamscore=0 clxscore=1015 malwarescore=0 phishscore=0 impostorscore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606300088 On 6/29/26 4:17 PM, Mukesh Ojha wrote: > In qcom_scm_probe(), devm_request_threaded_irq() is called before > smp_store_release(&__scm, scm). Two paths can dereference __scm before > it is published, both causing a NULL pointer dereference. > > The IRQ handler receives scm via its data argument but passes only wq_ctx > to qcom_scm_waitq_wakeup() and qcom_scm_get_completion(), which then > dereference __scm directly. Thread scm through both functions so the IRQ > handler path never touches __scm. > > Non-atomic SMC calls made during probe (e.g. from qcom_tzmem_init via > qcom_scm_shm_bridge_enable) can return WAITQ_SLEEP, causing > qcom_scm_wait_for_wq_completion() to run before __scm is published and > dereference it. Add platform_set_drvdata(pdev, scm) early in probe and > change qcom_scm_wait_for_wq_completion() to take the device pointer and > use dev_get_drvdata() to reach scm, removing any dependency on __scm. > > Fixes: 6bf325992236 ("firmware: qcom: scm: Add wait-queue handling logic") > Signed-off-by: Mukesh Ojha > --- [...] > -int qcom_scm_wait_for_wq_completion(u32 wq_ctx) > +int qcom_scm_wait_for_wq_completion(struct device *dev, u32 wq_ctx) I think it logically makes more sense to pass a struct qcom_scm* here and get the data from the caller, but potayto/potato Reviewed-by: Konrad Dybcio Konrad