From de4929b47683ed22d8c05f68d2d0f0cfd95b90a1 Mon Sep 17 00:00:00 2001 From: Muhammad Bilal Date: Sun, 20 Sep 2026 00:24:32 +0500 Subject: [PATCH] crypto: ccp - fix SFS ioctl race against device teardown sfs_ioctl() reads psp_master->sfs_data and caches it in sfs_dev before taking sfs_ioctl_mutex, while sfs_dev_destroy() frees sfs_dev->page and sfs_dev->command_buf with no locking at all and only clears psp->sfs_data afterwards. A call to sfs_ioctl() that reads sfs_data just before sfs_dev_destroy() runs will still acquire the mutex and go on to use the now-freed command buffer in send_sfs_cmd(). Have both functions take sfs_ioctl_mutex before touching psp->sfs_data, so a call that is already using sfs_dev completes before teardown can free it, and a call arriving after teardown sees sfs_data cleared and returns -ENODEV instead of racing it. Fixes: 648dbccc03a0 ("crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver") Signed-off-by: Muhammad Bilal Reviewed-by: Ashish Kalra Reviewed-by: Thomas Huth Signed-off-by: Herbert Xu --- drivers/crypto/ccp/sfs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/crypto/ccp/sfs.c b/drivers/crypto/ccp/sfs.c index a4777839790b..530141f8bc74 100644 --- a/drivers/crypto/ccp/sfs.c +++ b/drivers/crypto/ccp/sfs.c @@ -111,13 +111,13 @@ static long sfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) struct sfs_device *sfs_dev; int ret = 0; + guard(mutex)(&sfs_ioctl_mutex); + if (!psp_master || !psp_master->sfs_data) return -ENODEV; sfs_dev = psp_master->sfs_data; - guard(mutex)(&sfs_ioctl_mutex); - switch (cmd) { case SFSIOCFWVERS: dev_dbg(sfs_dev->dev, "in SFSIOCFWVERS\n"); @@ -191,8 +191,11 @@ static void sfs_exit(struct kref *ref) void sfs_dev_destroy(struct psp_device *psp) { - struct sfs_device *sfs_dev = psp->sfs_data; + struct sfs_device *sfs_dev; + guard(mutex)(&sfs_ioctl_mutex); + + sfs_dev = psp->sfs_data; if (!sfs_dev) return;