mailbox: mtk-adsp: fix UAF during device teardown

When the SOF audio driver fails to initialize (e.g. firmware boot
timeout), its devres unwind frees the snd_sof_dev object that the
mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback.
The mtk-adsp-mailbox shutdown clears the mailbox command registers
but leaves the IRQ line unmasked, so a late interrupt can still
queue a threaded handler after mbox_free_channel() had cleared
chan->cl, and mbox_chan_received_data() would then trigger UAF:

  BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version
   sof_ipc3_validate_fw_version
   sof_ipc3_do_rx_work
   sof_ipc3_rx_msg
   mt8196_dsp_handle_request
   mtk_adsp_ipc_recv
   mbox_chan_received_data
   mtk_adsp_mbox_isr
   irq_thread_fn
  Freed by task ...:
   kfree
   devres_release_all
   really_probe
   ... (sof-audio-of-mt8196 probe failure)

The crash was observed roughly three seconds after the failed probe.

disable_irq() in shutdown and enable_irq() in startup. disable_irq()
also waits for any in-flight interrupts, so by the time
mbox_free_channel() proceeds to clear chan->cl no rx_callback can run.

In addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked
between probe and the first client bind — otherwise an early interrupt
can crash on chan->cl == NULL in mbox_chan_received_data().

Fixes: af2dfa96c52d ("mailbox: mediatek: add support for adsp mailbox controller")
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>

diff --git a/drivers/mailbox/mtk-adsp-mailbox.c b/drivers/mailbox/mtk-adsp-mailbox.c
index 91487aa4d7da08f4f70a91c8635ec630b29b4c7c..8bcecddee0eb5c9acfd34b9e6e80a243560fae6b 100644 (file)
--- a/drivers/mailbox/mtk-adsp-mailbox.c
+++ b/drivers/mailbox/mtk-adsp-mailbox.c
@@ -19,6 +19,7 @@ struct mtk_adsp_mbox_priv {
        struct mbox_controller mbox;
        void __iomem *va_mboxreg;
        const struct mtk_adsp_mbox_cfg *cfg;
+       int irq;
 };
 
 struct mtk_adsp_mbox_cfg {
@@ -67,6 +68,8 @@ static int mtk_adsp_mbox_startup(struct mbox_chan *chan)
        writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_in);
        writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_out);
 
+       enable_irq(priv->irq);
+
        return 0;
 }
 
@@ -74,6 +77,8 @@ static void mtk_adsp_mbox_shutdown(struct mbox_chan *chan)
 {
        struct mtk_adsp_mbox_priv *priv = get_mtk_adsp_mbox_priv(chan->mbox);
 
+       disable_irq(priv->irq);
+
        /* Clear ADSP mbox command */
        writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_in);
        writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_out);
@@ -139,8 +144,10 @@ static int mtk_adsp_mbox_probe(struct platform_device *pdev)
        if (irq < 0)
                return irq;
 
+       priv->irq = irq;
        ret = devm_request_threaded_irq(dev, irq, mtk_adsp_mbox_irq,
-                                       mtk_adsp_mbox_isr, IRQF_TRIGGER_NONE,
+                                       mtk_adsp_mbox_isr,
+                                       IRQF_TRIGGER_NONE | IRQF_NO_AUTOEN,
                                        dev_name(dev), mbox->chans);
        if (ret < 0)
                return ret;