linux-kernel - Re: [PATCH 2/2] firmware: qcom: scm: fall back to kcalloc() for no SCM device bound

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMRc=MdCHWfmZORx=mjBzOcgub_hSAz9oF6CzovGpKfMkKqgPw@mail.gmail.com>
Date: Tue, 10 Sep 2024 10:37:46 +0200
From: Bartosz Golaszewski <brgl@...ev.pl>
To: Elliot Berman <quic_eberman@...cinc.com>
Cc: Bjorn Andersson <andersson@...nel.org>, Konrad Dybcio <konradybcio@...nel.org>, 
	Andrew Halaney <ahalaney@...hat.com>, Dmitry Baryshkov <dmitry.baryshkov@...aro.org>, 
	Rudraksha Gupta <guptarud@...il.com>, 
	"Linux regression tracking (Thorsten Leemhuis)" <regressions@...mhuis.info>, linux-arm-msm@...r.kernel.org, 
	linux-kernel@...r.kernel.org, 
	Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
Subject: Re: [PATCH 2/2] firmware: qcom: scm: fall back to kcalloc() for no
 SCM device bound

On Mon, Sep 9, 2024 at 11:04 PM Elliot Berman <quic_eberman@...cinc.com> wrote:
>
> On Mon, Sep 09, 2024 at 08:38:45PM +0200, Bartosz Golaszewski wrote:
> > From: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
> >
> > Older platforms don't have an actual SCM device tied into the driver
> > model and so there's no struct device which to use with the TZ Mem API.
> > We need to fall-back to kcalloc() when allocating the buffer for
> > additional SMC arguments on such platforms which don't even probe the SCM
> > driver and never create the TZMem pool.
> >
> > Fixes: 449d0d84bcd8 ("firmware: qcom: scm: smc: switch to using the SCM allocator")
> > Reported-by: Rudraksha Gupta <guptarud@...il.com>
> > Closes: https://lore.kernel.org/lkml/692cfe9a-8c05-4ce4-813e-82b3f310019a@gmail.com/<S-Del>
> > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
> > ---
> >  drivers/firmware/qcom/qcom_scm-smc.c | 28 ++++++++++++++++++++++++----
> >  1 file changed, 24 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/firmware/qcom/qcom_scm-smc.c b/drivers/firmware/qcom/qcom_scm-smc.c
> > index 2b4c2826f572..13f72541033c 100644
> > --- a/drivers/firmware/qcom/qcom_scm-smc.c
> > +++ b/drivers/firmware/qcom/qcom_scm-smc.c
> > @@ -147,6 +147,15 @@ static int __scm_smc_do(struct device *dev, struct arm_smccc_args *smc,
> >       return 0;
> >  }
> >
> > +static void smc_args_free(void *ptr)
> > +{
> > +     if (qcom_scm_get_tzmem_pool())
>
> I'm a little concerned about this check. I didn't think making SCM calls
> without the SCM device probed was possible until this report. We do
> worry about that in the downstream kernel. So, I'm not sure if this
> scenario is currently possible in the upstream kernel.

I didn't know about this either. And I think this should be fixed.

That being said: qcom-msm8960.dtsi doesn't have any SCM node and
there's no such compatible in the driver so it looks real.

Also: some of the calls seem to be ready for this and they check
whether __scm is set and use a NULL struct device pointer if not.

>
> It's possible that some driver makes SCM call in parallel to SCM device
> probing. Then, it might be possible for qcom_scm_get_tzmem_pool() to
> return NULL at beginning of function and then a valid pointer by the
> time we're freeing the ptr.
>

I thought the SCM module is initialized at subsys_initcall() exactly
for that reason? Because if the above can happen then we have more
problems than just that. What if we enable SHM bridge during probe?
I'm not even sure what would happen to SCM calls in progress that were
passed regular buffers before.

I think the SCM driver should be improved and not allow calls until it's probed.

Bart