From nobody Sat Sep 26 08:00:24 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id AB91822370A; Thu, 3 Sep 2026 11:13:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788434022; cv=none; b=LFuIR4lajEojfCIpFgy27khbdThYln0iibVTKDc/msRigkOVLQKZAHi+bhfPe+QnGP3rIokOGsEMgGbzFFDMk7cnoUCgDMQJrfvDb42EVoSl3HwzFtLRSS/Qzs8zT/bQgshgQLtggGOj31mnEPCTVZYEx44m6MFgzcr763PULTk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788434022; c=relaxed/simple; bh=hnkO0ad81/cmvkTj7LCgLnvnVWCyzJAabKPXcrfdrqI=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=a0D2YQhYR8OiWG5BWGuVj3TnQNcj4yfFuZxdTAK9b1tNmsTNU/fVoeiTpzjoIyz7kb2/1O6VAEAHIzEVzBtSrV0wYQsEGwuHo4AekDW4aq/ba/0ukO4aZ+dxCttdAqx7DOUSFvbjd9u0tzQWrj/qpDnYwA1dWI4qr6bDdUobxqo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=hn/1ovz1; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="hn/1ovz1" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 39200165C; Thu, 3 Sep 2026 04:13:36 -0700 (PDT) Received: from e127648.cambridge.arm.com (e127648.arm.com [10.1.39.91]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 42FC83F7D8; Thu, 3 Sep 2026 04:13:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1788434020; bh=hnkO0ad81/cmvkTj7LCgLnvnVWCyzJAabKPXcrfdrqI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hn/1ovz1YQJGcm+gPG2vHhsAFvftXp3flnVdklDE2yE4TexJc7psXl72MIWZbWs70 V2Thjv7U3ih1dYTYKFMQk3xFwkcS6nhL3RERw8PX1metPFj67lPYBv85xOnyP0GD6D Gfb2BiWhOjWlO3Uup2n4wtl5ljOioWmvA21+OR3A= From: Christian Loehle To: Sudeep Holla , Jassi Brar Cc: breno Leitao , linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 1/2] mailbox: pcc: Free the channel before unmapping the shared memory Date: Thu, 3 Sep 2026 12:13:27 +0100 Message-Id: <20260903111328.805352-2-christian.loehle@arm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260903111328.805352-1-christian.loehle@arm.com> References: <20260903111328.805352-1-christian.loehle@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Breno Leitao I am seeing a crash on PCC that is related to a an shared memory being unmapped before the IRQ is disabled, and the IRQ kicks in and hits the unmapped (NULL) address. This is a summary of what I see on my box: scmi_protocol scmi_dev.1: Message for 1 type 0 is not expected! Unable to handle kernel NULL pointer dereference at virtual address 000000= 0000000004 __handle_irq_event_percpu+0x1c4/0x9e0 handle_irq_event+0x98/0x218 handle_fasteoi_irq+0x230/0x750 generic_handle_domain_irq+0xac/0x138 gic_handle_irq+0x344/0x740 call_on_irq_stack+0x30/0x48 The trapping store is iowrite32(SCMI_SHMEM_FLAG_INTR_ENABLED, &shmem->header.flags), a write of 1 at offset 4 of a NULL base. But, back to the problem, pcc_mbox_free_channel() unmaps the shared memory and clears pchan->chan.shmem *before* freeing the IRQ (aka calling mbox_free_channel()). The interrupt is still live when the mapping goes away. Free the channel first, before the memory unmap. mbox_free_channel() calls pcc_shutdown(), which frees the platform interrupt, and then unmap shared memory. Fixes: 7f9e19f207be ("mailbox: pcc: Check before sending MCTP PCC response = ACK") Reviewed-by: Sudeep Holla Signed-off-by: Breno Leitao --- drivers/mailbox/pcc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index 9888dab64639..db30812c5051 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -438,12 +438,13 @@ void pcc_mbox_free_channel(struct pcc_mbox_chan *pcha= n) return; pchan_info =3D chan->con_priv; pcc_mbox_chan =3D &pchan_info->chan; + + mbox_free_channel(chan); + if (pcc_mbox_chan->shmem) { iounmap(pcc_mbox_chan->shmem); pcc_mbox_chan->shmem =3D NULL; } - - mbox_free_channel(chan); } EXPORT_SYMBOL_GPL(pcc_mbox_free_channel); =20 --=20 2.34.1 From nobody Sat Sep 26 08:00:24 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 98E7E3B995B; Thu, 3 Sep 2026 11:13:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788434024; cv=none; b=iSbavYth/KR/wuzXzn+et1MgW0cXZjAcl1i4zjdsUMaEueJLiBJTb21bZ75PxRVHsmE4zkjF2CJb8Z/aqVGXFiY+PsZMhVeH+kE+ftWNoUMUICxvjbvGweEFTAQd+Jw3rxPwV259ki1695ycX048eGiQkXb45FUlo4zXZSVPTGg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788434024; c=relaxed/simple; bh=U89IzzFoft7TfRALsnG7ekJ7+A8yWu1YKalPzY817Mo=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PozY37NsHvP4WEgcW7uIR8sMntXf1/EzFrf1udderWgBiRu5FDV8TzSedLC17hova0KG6RVvPSJ2RvfEBgYfpi3rMczJiL7qMgfV4br8s6doTNx8U091a6diAKJCdTUNzhzhAKe9C1JrWcvMd4IUKmY7J215oLtzpFVdZLpdncY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=VGyr7SRp; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="VGyr7SRp" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 20FD11596; Thu, 3 Sep 2026 04:13:38 -0700 (PDT) Received: from e127648.cambridge.arm.com (e127648.arm.com [10.1.39.91]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 540B53F7D8; Thu, 3 Sep 2026 04:13:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1788434021; bh=U89IzzFoft7TfRALsnG7ekJ7+A8yWu1YKalPzY817Mo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VGyr7SRpN7I3wrB0yR+yGl8aH4MKlyOc/B5S1YfKsM4/tIyE3QGbP/fYOudUrKKL7 H7ARoqqwhqH+3ytHuL+nl7duxHVT5LSiwyrx/vz0rAEWVblTA1KnaIckaC8VdwRtAj dXivUMLm8dfy8/wSGXanBM4oG0367UIcKjywUDBM= From: Christian Loehle To: Sudeep Holla , Jassi Brar Cc: breno Leitao , linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Christian Loehle Subject: [PATCH 2/2] mailbox: pcc: Serialize channel updates with shared memory teardown Date: Thu, 3 Sep 2026 12:13:28 +0100 Message-Id: <20260903111328.805352-3-christian.loehle@arm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260903111328.805352-1-christian.loehle@arm.com> References: <20260903111328.805352-1-christian.loehle@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mbox_free_channel() makes a PCC channel available before the subsequent shared-memory unmap. Without serialization, a concurrent request can bind a new client and replace the mapping, which the old release then unmaps. Serialize PCC channel acquisition and release. Keep the channel unavailable until the old shared-memory mapping has been removed. Suggested-by: Sudeep Holla Signed-off-by: Christian Loehle Reviewed-by: Sudeep Holla --- drivers/mailbox/pcc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index db30812c5051..14dc4a187bfc 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -53,6 +53,7 @@ #include #include #include +#include #include #include #include @@ -113,6 +114,7 @@ struct pcc_chan_info { #define to_pcc_chan_info(c) container_of(c, struct pcc_chan_info, chan) static struct pcc_chan_info *chan_info; static int pcc_chan_count; +static DEFINE_MUTEX(pcc_chan_mutex); =20 /* * PCC can be used with perf critical drivers such as CPPC @@ -392,6 +394,8 @@ pcc_mbox_request_channel(struct mbox_client *cl, int su= bspace_id) if (subspace_id < 0 || subspace_id >=3D pcc_chan_count) return ERR_PTR(-ENOENT); =20 + guard(mutex)(&pcc_chan_mutex); + pchan =3D chan_info + subspace_id; chan =3D pchan->chan.mchan; if (IS_ERR(chan) || chan->cl) { @@ -434,6 +438,8 @@ void pcc_mbox_free_channel(struct pcc_mbox_chan *pchan) struct pcc_chan_info *pchan_info; struct pcc_mbox_chan *pcc_mbox_chan; =20 + guard(mutex)(&pcc_chan_mutex); + if (!chan || !chan->cl) return; pchan_info =3D chan->con_priv; --=20 2.34.1