github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM

Browse Source 
bcm74110_rx_push_init_msg() allocates a GFP_ATOMIC struct for every
BCM_MSG_SVC_INIT word received from the PMC co-processor and appends it
to rx_svc_init_list with no cap on list length.  The only consumers of
this list (bcm74110_rx_pop_init_msg_block / bcm74110_rx_flush_msg) are
called only during probe and at shutdown respectively; after probe
completes, PMC firmware can continuously inject BCM_MSG_SVC_INIT words,
exhausting GFP_ATOMIC reserves and causing a whole-device denial of
service.

Add BCM74110_INIT_MSG_MAX (16 entries) as the maximum list depth.
bcm74110_rx_push_init_msg() now checks the count under the existing
rx_svc_list_lock before allocating; if the cap is reached the message is
dropped and a rate-limited warning is emitted.  The new rx_svc_init_count
field is decremented by bcm74110_rx_pop_init_msg() on successful dequeue
and reset to zero by bcm74110_rx_flush_msg() on shutdown.

Fixes: 52436007b8 ("mailbox: Add support for bcm74110")
Cc: stable@vger.kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Assisted-by: Anthropic:claude-sonnet-4.6 cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Acked-by: Justin Chen <justin.chen@broadcom.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
This commit is contained in:
Florian Fainelli 2026-08-25 12:16:19 -07:00 committed by Jassi Brar
parent 86976f7cc3
commit eb2ee50475
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/mailbox/bcm74110-mailbox.c
View File

@ -97,6 +97,8 @@ struct bcm74110_mbox_chan {
int type;
};
#define BCM74110_INIT_MSG_MAX 16
struct bcm74110_mbox {
struct platform_device *pdev;
void __iomem *base;
@ -105,6 +107,7 @@ struct bcm74110_mbox {
int rx_chan;
int rx_irq;
struct list_head rx_svc_init_list;
unsigned int rx_svc_init_count;
spinlock_t rx_svc_list_lock;
struct mbox_controller controller;
@ -148,7 +151,15 @@ static void bcm74110_rx_push_init_msg(struct bcm74110_mbox *mbox, u32 val)
msg->msg = val;
spin_lock(&mbox->rx_svc_list_lock);
if (mbox->rx_svc_init_count >= BCM74110_INIT_MSG_MAX) {
spin_unlock(&mbox->rx_svc_list_lock);
kfree(msg);
dev_warn_ratelimited(&mbox->pdev->dev,
"PMC INIT msg list full, dropping message\n");
return;
}
list_add_tail(&msg->list_entry, &mbox->rx_svc_init_list);
mbox->rx_svc_init_count++;
spin_unlock(&mbox->rx_svc_list_lock);
}
@ -225,6 +236,7 @@ static int bcm74110_rx_pop_init_msg(struct bcm74110_mbox *mbox, u32 func_type,
list_entry) {
if (BCM_MSG_GET_FIELD(msg->msg, FUNC) == func_type) {
list_del(&msg->list_entry);
mbox->rx_svc_init_count--;
found = true;
break;
}
@ -248,6 +260,7 @@ static void bcm74110_rx_flush_msg(struct bcm74110_mbox *mbox)
spin_lock_irqsave(&mbox->rx_svc_list_lock, flags);
list_splice_init(&mbox->rx_svc_init_list, &list_temp);
mbox->rx_svc_init_count = 0;
spin_unlock_irqrestore(&mbox->rx_svc_list_lock, flags);
list_for_each_entry_safe(msg, msg_tmp, &list_temp, list_entry) {