Re: [PATCH 0/2] firmware: stratix10-svc: fix kaddr dangling pointers and populate kaddr1

["NG, ADRIAN HO YIN" <adrian.ho.yin.ng@altera.com>]

On 9/3/2026 12:31 AM, Dinh Nguyen wrote:
>
>
> On 5/26/26 15:35, Adrian Ng Ho Yin wrote:
>> kaddr1/2/3 in the stratix10 service layer are set to addresses of local
>> arm_smccc_res fields that go out of scope when the setting function 
>> returns,
>> leaving dangling pointers in the callback data.
>>
>> Patch 1 fixes this by adding a1/a2/a3 scratch fields to struct
>> stratix10_svc_cb_data, which lives for the SVC thread lifetime, and
>> pointing kaddrN to those fields instead of the stack.
>>
>> Patch 2 uses the same mechanism to populate the previously unset 
>> kaddr1 in
>> svc_thread_cmd_config_status(), exposing firmware status details to 
>> callers.
>>
>> Adrian Ng Ho Yin (2):
>>    firmware: stratix10-svc: fix dangling kaddr pointers in callback data
>>    firmware: stratix10-svc: populate kaddr1 from config status response
>>
>>   drivers/firmware/stratix10-svc.c              | 45 ++++++++++++-------
>>   .../firmware/intel/stratix10-svc-client.h     | 17 +++++++
>>   2 files changed, 47 insertions(+), 15 deletions(-)
>>
>
> Do these patches need to get backport into a stable release? If so, 
> please add the appropriated Fixes tag.
>
> Thanks,
> Dinh
Hi Dinh,

The callbacks run while arm_smccc_res is still on the stack, and the
current clients copy kaddr* during the callback. They do not keep those
pointers afterwards, so this is not a stable bug.

I am dropping patch 1 for that reason. v2 will be only the kaddr1
populate on the config-status completed path, using &res.a1 like the
existing error path. That is a small feature, not a regression fix.

Thanks,
Adrian