From eb2ee504757674450a5e03e36e6b9340f064e599 Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 25 Aug 2026 12:16:19 -0700 Subject: [PATCH] mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM bcm74110_rx_push_init_msg() allocates a GFP_ATOMIC struct for every BCM_MSG_SVC_INIT word received from the PMC co-processor and appends it to rx_svc_init_list with no cap on list length. The only consumers of this list (bcm74110_rx_pop_init_msg_block / bcm74110_rx_flush_msg) are called only during probe and at shutdown respectively; after probe completes, PMC firmware can continuously inject BCM_MSG_SVC_INIT words, exhausting GFP_ATOMIC reserves and causing a whole-device denial of service. Add BCM74110_INIT_MSG_MAX (16 entries) as the maximum list depth. bcm74110_rx_push_init_msg() now checks the count under the existing rx_svc_list_lock before allocating; if the cap is reached the message is dropped and a rate-limited warning is emitted. The new rx_svc_init_count field is decremented by bcm74110_rx_pop_init_msg() on successful dequeue and reset to zero by bcm74110_rx_flush_msg() on shutdown. Fixes: 52436007b862 ("mailbox: Add support for bcm74110") Cc: stable@vger.kernel.org Signed-off-by: Florian Fainelli Assisted-by: Anthropic:claude-sonnet-4.6 cursor Signed-off-by: Danesh Petigara Acked-by: Justin Chen Signed-off-by: Jassi Brar --- drivers/mailbox/bcm74110-mailbox.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/mailbox/bcm74110-mailbox.c b/drivers/mailbox/bcm74110-mailbox.c index c8709d509912..bec138d76914 100644 --- a/drivers/mailbox/bcm74110-mailbox.c +++ b/drivers/mailbox/bcm74110-mailbox.c @@ -97,6 +97,8 @@ struct bcm74110_mbox_chan { int type; }; +#define BCM74110_INIT_MSG_MAX 16 + struct bcm74110_mbox { struct platform_device *pdev; void __iomem *base; @@ -105,6 +107,7 @@ struct bcm74110_mbox { int rx_chan; int rx_irq; struct list_head rx_svc_init_list; + unsigned int rx_svc_init_count; spinlock_t rx_svc_list_lock; struct mbox_controller controller; @@ -148,7 +151,15 @@ static void bcm74110_rx_push_init_msg(struct bcm74110_mbox *mbox, u32 val) msg->msg = val; spin_lock(&mbox->rx_svc_list_lock); + if (mbox->rx_svc_init_count >= BCM74110_INIT_MSG_MAX) { + spin_unlock(&mbox->rx_svc_list_lock); + kfree(msg); + dev_warn_ratelimited(&mbox->pdev->dev, + "PMC INIT msg list full, dropping message\n"); + return; + } list_add_tail(&msg->list_entry, &mbox->rx_svc_init_list); + mbox->rx_svc_init_count++; spin_unlock(&mbox->rx_svc_list_lock); } @@ -225,6 +236,7 @@ static int bcm74110_rx_pop_init_msg(struct bcm74110_mbox *mbox, u32 func_type, list_entry) { if (BCM_MSG_GET_FIELD(msg->msg, FUNC) == func_type) { list_del(&msg->list_entry); + mbox->rx_svc_init_count--; found = true; break; } @@ -248,6 +260,7 @@ static void bcm74110_rx_flush_msg(struct bcm74110_mbox *mbox) spin_lock_irqsave(&mbox->rx_svc_list_lock, flags); list_splice_init(&mbox->rx_svc_init_list, &list_temp); + mbox->rx_svc_init_count = 0; spin_unlock_irqrestore(&mbox->rx_svc_list_lock, flags); list_for_each_entry_safe(msg, msg_tmp, &list_temp, list_entry) {