From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 991802566E9 for ; Thu, 12 Feb 2026 05:29:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770874141; cv=none; b=uWv7Ad3fl9wGUe5gLCXAObFMA1E2ZhbwjH4x4k8om0snbE3d2zNkY7fP7GnQcxJKmcLijVS16uCrY1e5Of/07HyCXLzUHRXsctNOYODUHKWwBjzj8/5rgoXGxcvJtLLziJx9jBizftb/Qfwr1D6Vzkk230dXmleFbU2NeU4Lxzc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770874141; c=relaxed/simple; bh=udy/w8qXHu7isiYV75tcJIHiWKZ4yuEcdp47thkYftg=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=nwcFW0N6mwAV/IN/pIXA9AjjM+L0VsBQYLcZaGFboFRlJBei9UiJDCuJOMs7ZoMn32uZLvvG4GjXkj5+IMMrXyVhKIH4x0kHi+Ef/lHE2dUi9zfIpfcpXK+tAiCXYb37AUE8pUqJJzK+AuNfUHQNu0ry9c33kZw2/mDw+AdyndA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Ejc1UvGF; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Ejc1UvGF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 06EFCC4CEF7; Thu, 12 Feb 2026 05:29:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1770874141; bh=udy/w8qXHu7isiYV75tcJIHiWKZ4yuEcdp47thkYftg=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=Ejc1UvGFTYJw1sYOn7Q2XzJmlmYFxxxLmtzT0YwaWfXR7fOYHoP7u58CHp+fE89G4 g7GZY2nsAaKNQyjN+GY8Wea/VGWFIELbQXCKSyh9J7STzuzrgHPK4hHoL8KjGj77ly K/aNBxfKXc8zX+4WGT8wpQGevfrUcBEF3Aq2/MQTfciSJRaAy3SUlGkTwULKPRPmRj Oxbh/fg3pTVOKRizunypcogp0lkXD2rVNE/rCvK1hIFPv7eIkpdu/Nc/8ipxqBgGPQ tJXiT4NHgrx+QqqN+lZpgNzm7rlM+6Npwb6FM5XpioYX+nduPDNctsC2G56xnAZ1kM 444hILv9kqKNQ== Message-ID: <92fd8028-c145-4bcd-80b7-96de77f3adf0@kernel.org> Date: Wed, 11 Feb 2026 23:28:59 -0600 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled Content-Language: en-US To: Liwei Song , mahesh.rao@altera.com, matthew.gerlach@altera.com Cc: linux-kernel@vger.kernel.org References: <20260212040035.3182294-1-liwei.song@windriver.com> From: Dinh Nguyen In-Reply-To: <20260212040035.3182294-1-liwei.song@windriver.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 2/11/26 22:00, Liwei Song wrote: > When the Remote System Update (RSU) isn't enabled in the First Stage > Boot Loader (FSBL), the driver encounters a NULL pointer dereference when > excute svc_normal_to_secure_thread() thread, resulting in a kernel panic: > > Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 > Mem abort info: > ... > Data abort info: > ... > [0000000000000008] user address but active_mm is swapper > Internal error: Oops: 0000000096000004 [#1] SMP > Modules linked in: > CPU: 0 UID: 0 PID: 79 Comm: svc_smc_hvc_thr Not tainted 6.19.0-rc8-yocto-standard+ #59 PREEMPT > Hardware name: SoCFPGA Stratix 10 SoCDK (DT) > pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > pc : svc_normal_to_secure_thread+0x38c/0x990 > lr : svc_normal_to_secure_thread+0x144/0x990 > ... > Call trace: > svc_normal_to_secure_thread+0x38c/0x990 (P) > kthread+0x150/0x210 > ret_from_fork+0x10/0x20 > Code: 97cfc113 f9400260 aa1403e1 f9400400 (f9400402) > ---[ end trace 0000000000000000 ]--- > > The issue occurs because rsu_send_async_msg() fails when RSU is not enabled > in firmware, causing the channel to be freed via stratix10_svc_free_channel(). > However, the probe function continues execution and registers > svc_normal_to_secure_thread(), which subsequently attempts to access the > already-freed channel, triggering the NULL pointer dereference. > > Fix this by properly cleaning up the async client and returning early on > failure, preventing the thread from being used with an invalid channel. > > Fixes: 15847537b623 ("firmware: stratix10-rsu: Migrate RSU driver to use stratix10 asynchronous framework.") > Signed-off-by: Liwei Song > --- Applied! Thanks, Dinh