Commit cf0fd404 authored Sep 04, 2019 by Leonard Crestez Committed by Shawn Guo Oct 06, 2019

firmware: imx: warn on unexpected RX



The imx_scu_call_rpc function returns the result inside the
same "msg" struct containing the transmitted message. This is
implemented by holding a pointer to msg (which is usually on the stack)
in sc_imx_rpc and writing to it from imx_scu_rx_callback.

This means that if the have_resp parameter is incorrect or SCU sends an
unexpected response for any reason the most likely result is kernel stack
corruption.

Fix this by only setting sc_imx_rpc.msg for the duration of the
imx_scu_call_rpc call and warning in imx_scu_rx_callback if unset.

Print the unexpected response data to help debugging.

Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
Acked-by: Anson Huang <Anson.Huang@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>

parent 54ecb8f7

drivers/firmware/imx/imx-scu.c

+9 −1

Original line number	Diff line number	Diff line
		@@ -107,6 +107,12 @@ static void imx_scu_rx_callback(struct mbox_client c, void msg)
		struct imx_sc_rpc_msg *hdr;
		u32 *data = msg;

		if (!sc_ipc->msg) {
		dev_warn(sc_ipc->dev, "unexpected rx idx %d 0x%08x, ignore!\n",
		sc_chan->idx, *data);
		return;
		}

		if (sc_chan->idx == 0) {
		hdr = msg;
		sc_ipc->rx_size = hdr->size;
		@@ -165,6 +171,7 @@ int imx_scu_call_rpc(struct imx_sc_ipc sc_ipc, void msg, bool have_resp)
		mutex_lock(&sc_ipc->lock);
		reinit_completion(&sc_ipc->done);

		if (have_resp)
		sc_ipc->msg = msg;
		sc_ipc->count = 0;
		ret = imx_scu_ipc_write(sc_ipc, msg);
		@@ -187,6 +194,7 @@ int imx_scu_call_rpc(struct imx_sc_ipc sc_ipc, void msg, bool have_resp)
		}

		out:
		sc_ipc->msg = NULL;
		mutex_unlock(&sc_ipc->lock);

		dev_dbg(sc_ipc->dev, "RPC SVC done\n");

Admin message