Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Leonard Crestez <leonard.crestez@nxp.com>
To:     Anson Huang <anson.huang@nxp.com>,
        Aisheng Dong <aisheng.dong@nxp.com>
CC:     "shawnguo@kernel.org" <shawnguo@kernel.org>,
        "s.hauer@pengutronix.de" <s.hauer@pengutronix.de>,
        "kernel@pengutronix.de" <kernel@pengutronix.de>,
        "festevam@gmail.com" <festevam@gmail.com>,
        Daniel Baluta <daniel.baluta@nxp.com>,
        Abel Vesa <abel.vesa@nxp.com>,
        "linux-arm-kernel@lists.infradead.org" 
        <linux-arm-kernel@lists.infradead.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        dl-linux-imx <linux-imx@nxp.com>
Subject: Re: [PATCH] soc: imx: imx-scu: Getting UID from SCU should have
 response
Thread-Topic: [PATCH] soc: imx: imx-scu: Getting UID from SCU should have
 response
Thread-Index: AQHVYvBashyquDfUQEej9aDOPv0J5A==
Date:   Wed, 4 Sep 2019 07:34:06 +0000
Message-ID: <VI1PR04MB7023B9C325C54AA8112F1AE5EEB80@VI1PR04MB7023.eurprd04.prod.outlook.com>
References: <1567624394-25023-1-git-send-email-Anson.Huang@nxp.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: nxp.com does not designate
 permitted sender hosts)
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 40e1f21a-b14d-4900-12b2-08d7310a44e3
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Sep 2019 07:34:06.9669
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: CFtEgeZZyaEgbx3MGjg4ZLCi9NNEBxBfkT8wMfnkXuazU5RfI9tU1ixifIjh4dsrAlP30H5nBlNu3g2LVGgfgg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR04MB4606
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 2019-09-04 10:14 AM, Anson Huang wrote:=0A=
> The SCU firmware API for getting UID should have response,=0A=
> otherwise, the message stored in function stack could be=0A=
> released and then the response data received from SCU will be=0A=
> stored into that released stack and cause kernel NULL pointer=0A=
> dump.=0A=
=0A=
This fix looks good, but looking at imx-scu code it seems that passing =0A=
the incorrect "have_resp" argument to imx_scu_call_rpc or just receiving =
=0A=
an unexpected message from SCFW will always result in kernel stack =0A=
corruption!=0A=
=0A=
This is worth handling inside imx-scu itself: unless a response was =0A=
explicitly requested it should ignore and print a warning on rx, for =0A=
example by setting imx_sc_ipc to NULL when not waiting for a response.=0A=
=0A=
Holding on to arbitrary stack pointers is bad.=0A=
=0A=
--=0A=
Regards,=0A=
Leonard=0A=
=0A=
> diff --git a/drivers/soc/imx/soc-imx-scu.c b/drivers/soc/imx/soc-imx-scu.=
c=0A=
> index 50831eb..c68882e 100644=0A=
> --- a/drivers/soc/imx/soc-imx-scu.c=0A=
> +++ b/drivers/soc/imx/soc-imx-scu.c=0A=
> @@ -46,7 +46,7 @@ static ssize_t soc_uid_show(struct device *dev,=0A=
>   	hdr->func =3D IMX_SC_MISC_FUNC_UNIQUE_ID;=0A=
>   	hdr->size =3D 1;=0A=
>   =0A=
> -	ret =3D imx_scu_call_rpc(soc_ipc_handle, &msg, false);=0A=
> +	ret =3D imx_scu_call_rpc(soc_ipc_handle, &msg, true);=0A=
>   	if (ret) {=0A=
>   		pr_err("%s: get soc uid failed, ret %d\n", __func__, ret);=0A=
>   		return ret;=0A=