[PATCH] crypto: ccp - fix SFS ioctl race against device teardown

[PATCH] crypto: ccp - fix SFS ioctl race against device teardown

[Muhammad Bilal]

sfs_ioctl() reads psp_master->sfs_data and caches it in sfs_dev before
taking sfs_ioctl_mutex, while sfs_dev_destroy() frees sfs_dev->page
and sfs_dev->command_buf with no locking at all and only clears
psp->sfs_data afterwards. A call to sfs_ioctl() that reads sfs_data
just before sfs_dev_destroy() runs will still acquire the mutex and
go on to use the now-freed command buffer in send_sfs_cmd().

Have both functions take sfs_ioctl_mutex before touching
psp->sfs_data, so a call that is already using sfs_dev completes
before teardown can free it, and a call arriving after teardown sees
sfs_data cleared and returns -ENODEV instead of racing it.

Fixes: 648dbccc03a0 ("crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 drivers/crypto/ccp/sfs.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/ccp/sfs.c b/drivers/crypto/ccp/sfs.c
index a4777839790b..530141f8bc74 100644
--- a/drivers/crypto/ccp/sfs.c
+++ b/drivers/crypto/ccp/sfs.c
@@ -111,13 +111,13 @@ static long sfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	struct sfs_device *sfs_dev;
 	int ret = 0;
 
+	guard(mutex)(&sfs_ioctl_mutex);
+
 	if (!psp_master || !psp_master->sfs_data)
 		return -ENODEV;
 
 	sfs_dev = psp_master->sfs_data;
 
-	guard(mutex)(&sfs_ioctl_mutex);
-
 	switch (cmd) {
 	case SFSIOCFWVERS:
 		dev_dbg(sfs_dev->dev, "in SFSIOCFWVERS\n");
@@ -191,8 +191,11 @@ static void sfs_exit(struct kref *ref)
 
 void sfs_dev_destroy(struct psp_device *psp)
 {
-	struct sfs_device *sfs_dev = psp->sfs_data;
+	struct sfs_device *sfs_dev;
+
+	guard(mutex)(&sfs_ioctl_mutex);
 
+	sfs_dev = psp->sfs_data;
 	if (!sfs_dev)
 		return;
 
-- 
2.55.0

Re: [PATCH] crypto: ccp - fix SFS ioctl race against device teardown

[Kalra, Ashish]

On 9/19/2026 2:24 PM, Muhammad Bilal wrote:
> [You don't often get email from meatuni001@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> sfs_ioctl() reads psp_master->sfs_data and caches it in sfs_dev before
> taking sfs_ioctl_mutex, while sfs_dev_destroy() frees sfs_dev->page
> and sfs_dev->command_buf with no locking at all and only clears
> psp->sfs_data afterwards. A call to sfs_ioctl() that reads sfs_data
> just before sfs_dev_destroy() runs will still acquire the mutex and
> go on to use the now-freed command buffer in send_sfs_cmd().
> 
> Have both functions take sfs_ioctl_mutex before touching
> psp->sfs_data, so a call that is already using sfs_dev completes
> before teardown can free it, and a call arriving after teardown sees
> sfs_data cleared and returns -ENODEV instead of racing it.
> 
> Fixes: 648dbccc03a0 ("crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver")
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
>  drivers/crypto/ccp/sfs.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/crypto/ccp/sfs.c b/drivers/crypto/ccp/sfs.c
> index a4777839790b..530141f8bc74 100644
> --- a/drivers/crypto/ccp/sfs.c
> +++ b/drivers/crypto/ccp/sfs.c
> @@ -111,13 +111,13 @@ static long sfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
>         struct sfs_device *sfs_dev;
>         int ret = 0;
> 
> +       guard(mutex)(&sfs_ioctl_mutex);
> +
>         if (!psp_master || !psp_master->sfs_data)
>                 return -ENODEV;
> 
>         sfs_dev = psp_master->sfs_data;
> 
> -       guard(mutex)(&sfs_ioctl_mutex);
> -
>         switch (cmd) {
>         case SFSIOCFWVERS:
>                 dev_dbg(sfs_dev->dev, "in SFSIOCFWVERS\n");
> @@ -191,8 +191,11 @@ static void sfs_exit(struct kref *ref)
> 
>  void sfs_dev_destroy(struct psp_device *psp)
>  {
> -       struct sfs_device *sfs_dev = psp->sfs_data;
> +       struct sfs_device *sfs_dev;
> +
> +       guard(mutex)(&sfs_ioctl_mutex);
> 
> +       sfs_dev = psp->sfs_data;
>         if (!sfs_dev)
>                 return;
> 
> --
> 2.55.0
> 

Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>

Re: [PATCH] crypto: ccp - fix SFS ioctl race against device teardown

[Thomas Huth]

On 19/09/2026 21.24, Muhammad Bilal wrote:
> sfs_ioctl() reads psp_master->sfs_data and caches it in sfs_dev before
> taking sfs_ioctl_mutex, while sfs_dev_destroy() frees sfs_dev->page
> and sfs_dev->command_buf with no locking at all and only clears
> psp->sfs_data afterwards. A call to sfs_ioctl() that reads sfs_data
> just before sfs_dev_destroy() runs will still acquire the mutex and
> go on to use the now-freed command buffer in send_sfs_cmd().
> 
> Have both functions take sfs_ioctl_mutex before touching
> psp->sfs_data, so a call that is already using sfs_dev completes
> before teardown can free it, and a call arriving after teardown sees
> sfs_data cleared and returns -ENODEV instead of racing it.
> 
> Fixes: 648dbccc03a0 ("crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver")
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
>   drivers/crypto/ccp/sfs.c | 9 ++++++---
>   1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/crypto/ccp/sfs.c b/drivers/crypto/ccp/sfs.c
> index a4777839790b..530141f8bc74 100644
> --- a/drivers/crypto/ccp/sfs.c
> +++ b/drivers/crypto/ccp/sfs.c
> @@ -111,13 +111,13 @@ static long sfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
>   	struct sfs_device *sfs_dev;
>   	int ret = 0;
>   
> +	guard(mutex)(&sfs_ioctl_mutex);
> +
>   	if (!psp_master || !psp_master->sfs_data)
>   		return -ENODEV;
>   
>   	sfs_dev = psp_master->sfs_data;
>   
> -	guard(mutex)(&sfs_ioctl_mutex);
> -
>   	switch (cmd) {
>   	case SFSIOCFWVERS:
>   		dev_dbg(sfs_dev->dev, "in SFSIOCFWVERS\n");
> @@ -191,8 +191,11 @@ static void sfs_exit(struct kref *ref)
>   
>   void sfs_dev_destroy(struct psp_device *psp)
>   {
> -	struct sfs_device *sfs_dev = psp->sfs_data;
> +	struct sfs_device *sfs_dev;
> +
> +	guard(mutex)(&sfs_ioctl_mutex);
>   
> +	sfs_dev = psp->sfs_data;
>   	if (!sfs_dev)
>   		return;
>   

Reviewed-by: Thomas Huth <thuth@redhat.com>

Re: [PATCH] crypto: ccp - fix SFS ioctl race against device teardown

[Herbert Xu]

Muhammad Bilal <meatuni001@gmail.com> wrote:
> sfs_ioctl() reads psp_master->sfs_data and caches it in sfs_dev before
> taking sfs_ioctl_mutex, while sfs_dev_destroy() frees sfs_dev->page
> and sfs_dev->command_buf with no locking at all and only clears
> psp->sfs_data afterwards. A call to sfs_ioctl() that reads sfs_data
> just before sfs_dev_destroy() runs will still acquire the mutex and
> go on to use the now-freed command buffer in send_sfs_cmd().
> 
> Have both functions take sfs_ioctl_mutex before touching
> psp->sfs_data, so a call that is already using sfs_dev completes
> before teardown can free it, and a call arriving after teardown sees
> sfs_data cleared and returns -ENODEV instead of racing it.
> 
> Fixes: 648dbccc03a0 ("crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver")
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
> drivers/crypto/ccp/sfs.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt