From 645ae2edd5597501b4af3837a644877fbe194227 Mon Sep 17 00:00:00 2001 From: Beleswar Padhi Date: Thu, 1 Oct 2026 01:31:58 +0530 Subject: [PATCH] mailbox: ti-msgmgr: Read exact number of trailing message bytes ti_msgmgr_send_data() copies the message to the data registers in u32 units. This has been harmless so far because the clients (TI-SCI) always passed its preallocated message buffer, which is sized to the maximum message size (60 or 64 bytes, a multiple of 4), so the extra bytes read were still within the buffer. But, with a later TI-SCI update, the message size can be varying now and not guaranteed to be a multiple of 4, which would trigger KASAN out-of-bounds reports. Therefore, memcpy() only the trailing bytes into a zeroed u32 before writing it to the register. This is at most 3 bytes, so the overhead is negligible. Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver") Signed-off-by: Beleswar Padhi Acked-by: Andrew Davis Signed-off-by: Jassi Brar --- drivers/mailbox/ti-msgmgr.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c index 52136f99f54f..2079996092f5 100644 --- a/drivers/mailbox/ti-msgmgr.c +++ b/drivers/mailbox/ti-msgmgr.c @@ -20,6 +20,7 @@ #include #include #include +#include #define Q_DATA_OFFSET(proxy, queue, reg) \ ((0x10000 * (proxy)) + (0x80 * (queue)) + ((reg) * 4)) @@ -425,10 +426,15 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data) trail_bytes = message->len % sizeof(u32); if (trail_bytes) { - u32 data_trail = *word_data; + /* + * Copy only the trailing bytes instead of reading a full u32, + * as the message buffer may end right after them and a u32 + * read would go past the end of it. This also leaves all + * unused data as 0. + */ + u32 data_trail = 0; - /* Ensure all unused data is 0 */ - data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes)); + memcpy(&data_trail, word_data, trail_bytes); writel(data_trail, data_reg); data_reg += sizeof(u32); }