linux-kernel - [PATCH V2] remoteproc: imx_rproc: Add mutex protection for workqueue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250401140402.3676049-1-peng.fan@oss.nxp.com>
Date: Tue,  1 Apr 2025 22:04:02 +0800
From: "Peng Fan (OSS)" <peng.fan@....nxp.com>
To: Bjorn Andersson <andersson@...nel.org>,
	Mathieu Poirier <mathieu.poirier@...aro.org>,
	Shawn Guo <shawnguo@...nel.org>,
	Sascha Hauer <s.hauer@...gutronix.de>,
	Pengutronix Kernel Team <kernel@...gutronix.de>,
	Fabio Estevam <festevam@...il.com>,
	linux-remoteproc@...r.kernel.org (open list:REMOTE PROCESSOR (REMOTEPROC) SUBSYSTEM),
	imx@...ts.linux.dev (open list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE),
	linux-arm-kernel@...ts.infradead.org (moderated list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE),
	linux-kernel@...r.kernel.org (open list)
Cc: Peng Fan <peng.fan@....com>,
	Frank Li <Frank.Li@....com>
Subject: [PATCH V2] remoteproc: imx_rproc: Add mutex protection for workqueue

From: Peng Fan <peng.fan@....com>

Same as commit 47e6ab07018e ("remoteproc: imx_dsp_rproc: Add mutex
protection for workqueue") and commit 35bdafda40cc ("remoteproc:
stm32_rproc: Add mutex protection for workqueue"), imx_rproc driver
also has similar issue, although no issue reported until now.

The workqueue may execute late even after remoteproc is stopped or
stopping, some resources (rpmsg device and endpoint) have been
released in rproc_stop_subdevices(), then rproc_vq_interrupt()
accessing these resources will cause kennel dump.

Call trace:
 virtqueue_add_split
 virtqueue_add_inbuf
 rpmsg_recv_done
 vring_interrupt
 rproc_vq_interrupt
 imx_rproc_vq_work
 process_one_work
 worker_thread
 kthread
 ret_from_fork

Reviewed-by: Frank Li <Frank.Li@....com>
Signed-off-by: Peng Fan <peng.fan@....com>
---

V2:
 Add RPROC_ATTACHED check, because i.MX supports remote cores started by
 bootloader.
 Update commit and add R-b from Frank

 drivers/remoteproc/imx_rproc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
index 74299af1d7f1..4819a9e57543 100644
--- a/drivers/remoteproc/imx_rproc.c
+++ b/drivers/remoteproc/imx_rproc.c
@@ -5,6 +5,7 @@
 
 #include <dt-bindings/firmware/imx/rsrc.h>
 #include <linux/arm-smccc.h>
+#include <linux/cleanup.h>
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/firmware/imx/sci.h>
@@ -785,6 +786,11 @@ static void imx_rproc_vq_work(struct work_struct *work)
 					      rproc_work);
 	struct rproc *rproc = priv->rproc;
 
+	guard(mutex)(&rproc->lock);
+
+	if (rproc->state != RPROC_RUNNING && rproc->state != RPROC_ATTACHED)
+		return;
+
 	idr_for_each(&rproc->notifyids, imx_rproc_notified_idr_cb, rproc);
 }
 
-- 
2.37.1