[PATCH 3/3] firmware: arm_scmi: Unregister notifier on enable failure

[Sudeep Holla]

scmi_notifier_register() adds the caller's notifier block before
enabling the corresponding event at the platform.

If enablement fails, the caller receives an error and can free its
notifier block. A concurrent registration can retain and later enable
the handler, leaving the failed caller's block in its notification
chain. Event delivery can then dereference the freed block.

Remove the notifier block before dropping the handler reference when
event enablement fails.

Reported-by: Sashiko <sashiko-bot at kernel.org>
Closes: https://sashiko.dev/#/bug/linux-c3c9437c-ba1a-4db6-837f-cb0950d89018
Fixes: e7c215f358a3 ("firmware: arm_scmi: Add notification callbacks-registration")
Signed-off-by: Sudeep Holla <sudeep.holla at kernel.org>
---
 drivers/firmware/arm_scmi/notify.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/arm_scmi/notify.c b/drivers/firmware/arm_scmi/notify.c
index fb60fb07c0ed..e5de0d29c346 100644
--- a/drivers/firmware/arm_scmi/notify.c
+++ b/drivers/firmware/arm_scmi/notify.c
@@ -1395,8 +1395,10 @@ static int scmi_notifier_register(const struct scmi_handle *handle,
 	/* Enable events for not pending handlers */
 	if (!IS_HNDL_PENDING(hndl)) {
 		ret = scmi_event_handler_enable_events(hndl);
-		if (ret)
+		if (ret) {
+			blocking_notifier_chain_unregister(&hndl->chain, nb);
 			scmi_put_handler(ni, hndl);
+		}
 	}
 
 	return ret;
-- 
2.43.0