From nobody Sat Jul 25 02:34:54 2026 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9158F632 for ; Mon, 20 Jul 2026 13:55:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784555745; cv=none; b=js8aAjBRpTHGNOSFdenwUAEZx6XYs1jvSogyCbv8zRiWobvECDdltnW9U838dq/dM7Xvq26V+Rmd9FJV2w/2jJHsEy6vBiMosL7FmE+AL8aqsLVotzJi3L8OOezPD5Ll+KGFlfvvnxG8Jd1MpfEgIXgTxluYWlfPMbkJG1tTdjQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784555745; c=relaxed/simple; bh=TPvDhOM/G5Ox46QDmSOEhQ2uaWLJXTIQ+1GgCbHDgFs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Y5DEYphIEuvV0WxT9k6Y1FbPoWdcF6DZv84SSGweB1r2n0W2b2eYyaIkRlHdqpqm4QVfGQtDHsoP1nNNbMzO9Vzq0UlzxpK57yfpIt0TmcIaQtbFE/w7K4sOYkfTUM6MRbHzSd4lVpa//Iv3YpMm46FQpCxzffR8sXqfOKcst6I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=c6zh5CpV; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="c6zh5CpV" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-493f6de72faso26795695e9.0 for ; Mon, 20 Jul 2026 06:55:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784555742; x=1785160542; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=N1G6MUTItawGdl9kT6xgYXezu1UMlR9b+KB/O0a8o3c=; b=c6zh5CpVmhXTdeWKAKtYaku1YQxQwwwnS2jpwoplNlZzcC4jdNAZAq2BcL2+EO5Kqb 0B2g574bG8RAcbIBp5WmrfzgXBl2K8b+t3xjOGXMhFdxZLOeTaKSorLrnBwY900BzuT2 WxY+fyG6RHI2lonUKq1KHAyn7Dw1O6PXq7OrrwUIE+s2PNoLFWrwFNkqLyij5FcEWSvZ Ki/8utMxikufCQTFUqbKkf3A30K5n7SIcxGEynolBkdRvselac+iLCn4W4y9/kbj+2uH gEsahZFfvjxHZseitPqu1kqxybZB1AoHRW13X1BA3oFCbm6pkE3eJdpnkEoZaJm4NaiD i70Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784555742; x=1785160542; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=N1G6MUTItawGdl9kT6xgYXezu1UMlR9b+KB/O0a8o3c=; b=fyQAkZNYrOPJGfVbbztbug6Gbpd8doK65iGyJ7zkyvLGU/W1PWXZ0lJw7Vi5NU7Uts iDa9Qyp3ZIJYLIlkaq0ZuvY9Z/AoIowYKYA/RGn4tdrC03ibclb/d513CwdhJvMFe9Er hAWxDX8IzicMjwGBUEK5+IaWFbpOtGaeUwqZx7RmvfJGqFlWYsL8yEh5HlMeLlqioyV7 ayITtKasKhyHf2IZwtnpUMRov9SpFV7slZxKPU2TyDo51MN0T92YBFX+1FXDt2CBiOKZ i1C7SgdKkippO3rSdn2hkqKihRoLClwuIkF9SqxfLR0mVLvd3qmEeBv3phg9sBrcYuOO 4mgQ== X-Forwarded-Encrypted: i=1; AHgh+RoSdgwbMlFHcBuSe50HKiSK+1FHnIfxeNckZrW7JxsdnLoPBZH/NmdeyfQp4a9B8KBLMuLHQiryfOdXqKE=@vger.kernel.org X-Gm-Message-State: AOJu0YwYX2zOJ0j1oeAcoJr9QMp3+icbbv6l8cG1ugxv9XRJCQaWaFOL XHbl6McfcEzZEtqqEQXDCDF9O9rjiMGm2jyoSOdbN4dWe3cdeJv1rwtf X-Gm-Gg: AfdE7cmAgGwr9VUqnyyNWby28u+C/2tuDSSNtYOtXqXWOAEhG79lznv/y76e8AbKvoG asM6J1wtg5JT4AMAOhdSsZyF0zrrlhwHvW+dZOI2RZo29hBRa2jSDIj9pcq/RafSDK+ksvtyMbN NIPfCam7RDAGIr1yGPK/X1tHkh0y5AnFEkm2kVxotsDr3KpqV6kOHxT7hZd35rRVvE6Ne6XVitL nncP8pIieNH4bsYOcyUk+A7AY+MYVjFpNnlDjgReCOjjpbmpbGz8TE2Z+TGQgEFTtfuszWDA9g9 qGOiOvVBzAk9B2XJCmKESGZvxdJdb29NWAWBLMo3u3tq5m11icMxbN+kujn9lMwiEbEdVSHrQO+ NC/11K5zwyQ26blkIJOjslYMV7hl0SFcXR5xUEPVIWHa88nYi5zdeH/ofPamwh5+oW8wgZ6QTA2 tMoK8XGumglJyozfSp4WHBsATy+ch4YDiSzSdg8sclJ48MgmF0KQ== X-Received: by 2002:a05:600c:6289:b0:493:b4a3:5ab0 with SMTP id 5b1f17b1804b1-4954a33dc26mr146084685e9.13.1784555741410; Mon, 20 Jul 2026 06:55:41 -0700 (PDT) Received: from osama.. ([2a02:908:185:7e40:177b:1470:c99b:b6d9]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4954a2b87c6sm512521655e9.7.2026.07.20.06.55.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 06:55:40 -0700 (PDT) From: Osama Abdelkader To: Boris Brezillon , Steven Price , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: Osama Abdelkader , stable@vger.kernel.org Subject: [PATCH] drm/panthor: snapshot firmware interface counts before loops Date: Mon, 20 Jul 2026 15:55:18 +0200 Message-ID: <20260720135518.17927-1-osama.abdelkader@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The firmware exposes the global group count and per-group stream count in the shared control interface. These values are validated before being used as loop bounds, but the memory is shared with the MCU firmware and can be changed after validation. Read each count once with READ_ONCE() and use the validated snapshot as the loop bound. This keeps the loop bounds consistent with the validation and prevents the compiler from reloading a firmware-controlled count during iteration. Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader --- drivers/gpu/drm/panthor/panthor_fw.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor= /panthor_fw.c index e2fcbd639c3c..6e6da98d795e 100644 --- a/drivers/gpu/drm/panthor/panthor_fw.c +++ b/drivers/gpu/drm/panthor/panthor_fw.c @@ -959,6 +959,7 @@ static int panthor_init_csg_iface(struct panthor_device= *ptdev, u64 shared_section_sz =3D panthor_kernel_bo_size(ptdev->fw->shared_sectio= n->mem); u64 iface_offset =3D CSF_GROUP_CONTROL_OFFSET + ((u64)csg_idx * glb_iface->control->group_stride); + u32 stream_num; unsigned int i; =20 if (iface_offset > shared_section_sz || @@ -972,8 +973,8 @@ static int panthor_init_csg_iface(struct panthor_device= *ptdev, csg_iface->output =3D iface_fw_to_cpu_addr(ptdev, csg_iface->control->out= put_va, sizeof(*csg_iface->output)); =20 - if (csg_iface->control->stream_num < MIN_CS_PER_CSG || - csg_iface->control->stream_num > MAX_CS_PER_CSG) + stream_num =3D READ_ONCE(csg_iface->control->stream_num); + if (stream_num < MIN_CS_PER_CSG || stream_num > MAX_CS_PER_CSG) return -EINVAL; =20 if (!csg_iface->input || !csg_iface->output) { @@ -990,7 +991,7 @@ static int panthor_init_csg_iface(struct panthor_device= *ptdev, } } =20 - for (i =3D 0; i < csg_iface->control->stream_num; i++) { + for (i =3D 0; i < stream_num; i++) { int ret =3D panthor_init_cs_iface(ptdev, csg_idx, i); =20 if (ret) @@ -1015,6 +1016,7 @@ static int panthor_fw_init_ifaces(struct panthor_devi= ce *ptdev) { struct panthor_fw_global_iface *glb_iface =3D &ptdev->fw->iface.global; u64 shared_section_sz =3D panthor_kernel_bo_size(ptdev->fw->shared_sectio= n->mem); + u32 group_num; unsigned int i; =20 if (!ptdev->fw->shared_section->mem->kmap) @@ -1034,17 +1036,17 @@ static int panthor_fw_init_ifaces(struct panthor_de= vice *ptdev) return -EINVAL; } =20 - if (glb_iface->control->group_num > MAX_CSGS || - glb_iface->control->group_num < MIN_CSGS) { + group_num =3D READ_ONCE(glb_iface->control->group_num); + if (group_num > MAX_CSGS || group_num < MIN_CSGS) { drm_err(&ptdev->base, "Invalid number of control groups"); return -EINVAL; } =20 - for (i =3D 0; i < glb_iface->control->group_num; i++) { + for (i =3D 0; i < group_num; i++) { int ret =3D panthor_init_csg_iface(ptdev, i); =20 if (ret) return ret; } =20 drm_info(&ptdev->base, "CSF FW using interface v%d.%d.%d, Features %#x In= strumentation features %#x", --=20 2.43.0