From nobody Sat Jul 25 16:19:19 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 443AC3BBFBE for ; Thu, 16 Jul 2026 08:16:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784189774; cv=none; b=jAvR0ZBHCg3vEaXSeP1L5To1TUOI1HgBmRqDYy/A8PgiuckrwTBkvpn14ISs/P9XJLd1HA+PybQ/I094UVeDrFB4qmQ89qecV6HE07drWqwJgsqiQuSfkgtz0D/AmZV4jmBz2JQUO+kqDB6iUO+U3noyXgIaIyFGA8F0FnAhWTs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784189774; c=relaxed/simple; bh=zuqzZXCp/woKXCqBIjwV+EoLx91zzOso8HxOOXoirCM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kIa5Y3gK6jsNwckEUoeb632rkttn9yUgIbm7eJRD5CeMnF+GVXreNADjRBUXDwr7NaEbcXuZlQxtSza2KMAIU9uryqqzheZsd8Sy/LQa4xv0wN1igz2UwTTO+EOcHqh6JAnzr7I8BjBdQUiKpcDfUQI4UiHDOiI2p4Sm6UiMTa4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=H058Su1I; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=LInzLKLH; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="H058Su1I"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="LInzLKLH" Received: from pps.filterd (m0279862.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66G7E3Vm1883856 for ; Thu, 16 Jul 2026 08:16:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:message-id:mime-version :subject:to; s=qcppdkim1; bh=MByGLpxRNW7YQ56ZcsupMkMp3H5PJqKf4yS 7m1GeFHw=; b=H058Su1IP9RyN71toSHhcAGLg6Lamdv+csQDPI4HBSJkOIG5CaU EKriN+UYya8VMmwPvgCzVWj59JfTcSh/y/PSigeGU856HEnQbaoMbIfbtgqc2IW6 OkhugeFVn7KraLUdPu/VMMJb29JTnEgIM3T+z/hU67Iz64u1rzMq0HZU+yjAzvCM yPNLXTkNpt48yXWhgn49EnlzVRepNE17njovsN982ld8ANNFMwL+LP10QLr3OYzX 2+JIspXVWA6kubTQMb8Yof8PIXZ+vUwBmrrgFXECZbkmV3DKTPCyBKT9cWGPOqFN 98qgY/F2G4g1Vf4vm/TgMLPPGdE5cbbLwPw== Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4feehvarxa-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 16 Jul 2026 08:16:09 +0000 (GMT) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2ccb6f6a3f4so6728495ad.1 for ; Thu, 16 Jul 2026 01:16:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784189769; x=1784794569; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=MByGLpxRNW7YQ56ZcsupMkMp3H5PJqKf4yS7m1GeFHw=; b=LInzLKLHW/TqxCNZfWRsbwhaxamPLeL9gfkukNJMtqPnfNGoIrC8/PQzX0B5LixTPZ +ntOdJtoY6SNByxhnilT2u1VUu0u4vy8duc6+7PNmIOcOLyfQBDhVjQ7OsHlIqGh63Og H9TV2ZbPsvuB8hXAABjAwsKcCowPsuEDf2i0d4fEB49Be8keUbTOlgWyQyOHxonHMYnv UiaxczqhWgqMbOwbkynHHOjFF5yOW1gp2ZYx330nTIEY/XilBOrN/EbQAG8qU5RgpTKE WdznEBWcgGa/445r+03BB06bZOyi75nFlWBxMcelnQnjRdkxpmYJz5kDtI6iffN3p8uO Ev8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784189769; x=1784794569; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MByGLpxRNW7YQ56ZcsupMkMp3H5PJqKf4yS7m1GeFHw=; b=fOsXM6Rmdz5A0oc1R9UBo+dwyM6W640DhuSkNc/V6ZBWMVajuDOL53hUYW23sb04fN K4FChbUrNR2XbTrBWjdIiX1s1rwqlu1VbZkLfc5E4yGW3uIFpEtZZQqj9X564+SNHQAg kJFp09pZjAlNhfBButofOsoV5lvH/jBmR2Vo6H6W4yGEqd6aByaoHouh0GrlGlqQS+uE KjWxKCYuDx9eBBh8M4fv4Qznrib9sVdzmVtpS+SLv21DxX2oqFZdBiHM/sjfKwz1HFOl 4AsCM1fxcZdPDbH7SKF4UbqYMeB4azYv3GcbYznDWJUTI3Wm9s3kEacx/neOW5jECxs2 eFnA== X-Forwarded-Encrypted: i=1; AHgh+Rruaips3g68NeE1Yb1M5F9v8YWj9wOeP/w+X/mhGkcEpm/mpvTEyU8qiErM3BJ9QOr9f9am4UA24z+u5hI=@vger.kernel.org X-Gm-Message-State: AOJu0YxJIpmLmRTUCE+NudcGOyuo0Z2zqAaB02geWuzs5OU4/paXnIRB 1EGIOHe9/dPrRiJ6enimvsvdxfG5ftdJHEWWcXWexLaJ714wvIk13k99ApJ8mAQi2bnFSj5iGQp iBpEBhm1AsHO7XluY2Qjxw+S6IDOdHmJB7W2TW2d3PqIN+mWBRLcV9PKrsw+e3+6iPTk= X-Gm-Gg: AfdE7ck5mCi56PaJBV6NyGf8Z1UZoa/a5+a37CBL2cSQpPCmC5FWom3XaG+HVAeI6ps VI3qu6PnMuGHWOvxxUBW73Q2icWcdcGdP9b1JBvMXCiriC57d2DrvLSMMoNqgoHuHTeU/alP+ru WqmzBsDzKJZvocXvh8W6gEHPT8NvYuUsrQtr4gOXq8P6hn+yJWYaS11k8lp2uoNQ7xTgLFXuKGm peoe1nYxOrbUqz3ioGHt+zGNYCvyfQxTglzoT3RuvfgvCARQIYtw8rk9+xADNsORAX7wb6Ed8I/ UmFnsjEQCo23jKNZyKrmPpN/HNMIVv5LJ/G2QL1ie+VbZwWQKsRNIZgdk2tvfXPGZ9JA6ujywsl p/F+mNvW7GCOkBvuRKtlVqFAMuHw= X-Received: by 2002:a17:903:3204:b0:2c7:c385:c5a7 with SMTP id d9443c01a7336-2cf1f578795mr17372825ad.26.1784189768643; Thu, 16 Jul 2026 01:16:08 -0700 (PDT) X-Received: by 2002:a17:903:3204:b0:2c7:c385:c5a7 with SMTP id d9443c01a7336-2cf1f578795mr17372395ad.26.1784189768022; Thu, 16 Jul 2026 01:16:08 -0700 (PDT) Received: from hu-mojha-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf1073a3c2sm15891595ad.83.2026.07.16.01.16.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Jul 2026 01:16:07 -0700 (PDT) From: Mukesh Ojha To: Luis Chamberlain , Russ Weight , Danilo Krummrich , Greg Kroah-Hartman , "Rafael J. Wysocki" , Anirudh Rayabharam , Shuah Khan Cc: driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, Mukesh Ojha Subject: [PATCH] firmware_loader: do not queue completed sysfs fallback requests Date: Thu, 16 Jul 2026 13:46:01 +0530 Message-ID: <20260716081601.1674470-1-mukesh.ojha@oss.qualcomm.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Authority-Analysis: v=2.4 cv=ZpDd7d7G c=1 sm=1 tr=0 ts=6a589349 cx=c_pps a=IZJwPbhc+fLeJZngyXXI0A==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_K5XuSEh1TEqbUxoQ0s3:22 a=EUspDBNiAAAA:8 a=LoHWregEG7KfMwwwpb0A:9 a=uG9DUKGECoFWVXl0Dc02:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE2MDA4NCBTYWx0ZWRfXx0Jwxgwklv08 0WRfOONhaNqEcEcT/9FcrCi6lvlFfH2sr2aX3Jw/qfaxvb+w0UkRAtqPWQvFcYvLQmCO+tFb6XN J2/qZcJzPz6+JtGCjE/+WysJjd/b4jtJfeSx31H0hKWUZ1pSHyBvrv4HwhZGyDQoPpEl4lOSo9K dw5+30kbUQ0LtHoQkClztuDNRmw+9RsgzKne52gvNPmrplqJ6vieCRNikyh/OYA4Sj5vXlVOcd/ pH+mWnaWHvpoYv0U49OM7DosgkY+udd+NVJ88A8WAAxESrW1pnStXjug8Cbk+wWMIkGVe9HXy/L I77RcVkHW46JlAd1kr0jFYFeRjManJ1UwrxCOJtX5N6Wq/Ti/DO5Kump6mDjEWtEzN+KtKO63EE 1IprjlMiSvwwS/wxJ6rzEwIUZiY12AowQ+s1WF9rtS+gMZbJs8sNhmXhZX4f4rQM5NH1xqniRiJ Yru/RkT/kHi1KKBNZJA== X-Proofpoint-GUID: 0c-mhZ09xxqy_W7mKc6pFA5UBzRnZqQd X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE2MDA4NCBTYWx0ZWRfX7d3/kspA/0YU 5xWmC/lFBylYiN4mYfCJ9JfSvr/zwj/0KGfPs9YtrGnfJJnCVRSS9EY8zp4+l6nLGNNO5/5JSFt ufk31PsqG08hScBzIAN1PrWLqirjkug= X-Proofpoint-ORIG-GUID: 0c-mhZ09xxqy_W7mKc6pFA5UBzRnZqQd X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-16_03,2026-07-15_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 bulkscore=0 spamscore=0 lowpriorityscore=0 impostorscore=0 phishscore=0 adultscore=0 suspectscore=0 clxscore=1015 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607160084 Content-Type: text/plain; charset="utf-8" fw_load_sysfs_fallback() calls device_add() before adding the fw_priv to pending_fw_head. device_add() publishes the fallback loading interface, so a userspace helper which discovers the device by scanning sysfs can write 0 to the loading attribute and complete the request before it is queued as pending. In that interleaving firmware_loading_store() calls fw_state_done() while pending_list still points to itself, so it cannot remove an entry from pending_fw_head. The subsequent unconditional list_add() then queues an already-completed fw_priv. Once the request is released, pending_fw_head can retain a pointer to freed memory and the next fallback request can fault while validating the list. Only in-flight fallback requests need suspend or reboot abort handling. If the request is already DONE after device_add(), return success from the fallback path without sending another uevent, waiting again, or queueing it as pending. This preserves the invariant that pending_fw_head contains only active fallback requests. Fixes: 75d95e2e39b2 ("firmware_loader: fix use-after-free in firmware_fallb= ack_sysfs") Signed-off-by: Mukesh Ojha --- drivers/base/firmware_loader/fallback.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmwar= e_loader/fallback.c index 3ef0b312ae71..ffe1b3784788 100644 --- a/drivers/base/firmware_loader/fallback.c +++ b/drivers/base/firmware_loader/fallback.c @@ -95,6 +95,15 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sy= sfs, long timeout) retval =3D -EINTR; goto out; } + /* + * device_add() exposes the loading interface before pending_list is + * linked into pending_fw_head, so fw_state_done() may run first. + */ + if (fw_state_is_done(fw_priv)) { + mutex_unlock(&fw_lock); + goto out; + } + list_add(&fw_priv->pending_list, &pending_fw_head); mutex_unlock(&fw_lock); =20 --=20 2.53.0