Messages in this thread Patch in this message | | | From | Qiujun Huang <> | Subject | [PATCH v1] firmware: arm_scmi: Fix NULL pointer dereference in mailbox_clear_channel | Date | Wed, 30 Aug 2023 01:07:47 +0800 |
| |
There is a race between the failure of probe and rx_callback (due to a delayed response).
scmi_probe scmi_acquire_protocal do_xfer timeout mailbox_chan_free <--- delay response rx_callback mbox_free_channel cinfo->transport_info = NULL mailbox_clear_channel dereference cinfo->transport_info
This patch check for it, and clear the channel at mailbox_chan_free.
Signed-off-by: Qiujun Huang <hqjagain@gmail.com> --- drivers/firmware/arm_scmi/mailbox.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/arm_scmi/mailbox.c b/drivers/firmware/arm_scmi/mailbox.c index 19246ed1f01f..32c5fe0b8c29 100644 --- a/drivers/firmware/arm_scmi/mailbox.c +++ b/drivers/firmware/arm_scmi/mailbox.c @@ -230,6 +230,7 @@ static int mailbox_chan_free(int id, void *p, void *data) smbox->chan = NULL; smbox->chan_receiver = NULL; smbox->cinfo = NULL; + shmem_clear_channel(smbox->shmem); }
return 0; @@ -284,7 +285,8 @@ static void mailbox_clear_channel(struct scmi_chan_info *cinfo) { struct scmi_mailbox *smbox = cinfo->transport_info;
- shmem_clear_channel(smbox->shmem); + if (smbox) + shmem_clear_channel(smbox->shmem); }
static bool -- 2.30.2 | |