[PATCH] mailbox: mtk-adsp: fix UAF during device teardown

[Jassi Brar]

On Mon, Apr 27, 2026 at 9:56 PM Sergey Senozhatsky
<senozhatsky at chromium.org> wrote:
>
> When the SOF audio driver fails to initialize (e.g. firmware boot
> timeout), its devres unwind frees the snd_sof_dev object that the
> mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback.
> The mtk-adsp-mailbox shutdown clears the mailbox command registers
> but leaves the IRQ line unmasked, so a late interrupt can still
> queue a threaded handler after mbox_free_channel() had cleared
> chan->cl, and mbox_chan_received_data() would then trigger UAF:
>
>   BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version
>    sof_ipc3_validate_fw_version
>    sof_ipc3_do_rx_work
>    sof_ipc3_rx_msg
>    mt8196_dsp_handle_request
>    mtk_adsp_ipc_recv
>    mbox_chan_received_data
>    mtk_adsp_mbox_isr
>    irq_thread_fn
>   Freed by task ...:
>    kfree
>    devres_release_all
>    really_probe
>    ... (sof-audio-of-mt8196 probe failure)
>
> The crash was observed roughly three seconds after the failed probe.
>
> disable_irq() in shutdown and enable_irq() in startup. disable_irq()
> also waits for any in-flight interrupts, so by the time
> mbox_free_channel() proceeds to clear chan->cl no rx_callback can run.
>
> In addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked
> between probe and the first client bind — otherwise an early interrupt
> can crash on chan->cl == NULL in mbox_chan_received_data().
>
> Fixes: af2dfa96c52d ("mailbox: mediatek: add support for adsp mailbox controller")
> Signed-off-by: Sergey Senozhatsky <senozhatsky at chromium.org>
> ---
>  drivers/mailbox/mtk-adsp-mailbox.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mailbox/mtk-adsp-mailbox.c b/drivers/mailbox/mtk-adsp-mailbox.c
> index 91487aa4d7da..8bcecddee0eb 100644
> --- a/drivers/mailbox/mtk-adsp-mailbox.c
> +++ b/drivers/mailbox/mtk-adsp-mailbox.c
> @@ -19,6 +19,7 @@ struct mtk_adsp_mbox_priv {
>         struct mbox_controller mbox;
>         void __iomem *va_mboxreg;
>         const struct mtk_adsp_mbox_cfg *cfg;
> +       int irq;
>  };
>
>  struct mtk_adsp_mbox_cfg {
> @@ -67,6 +68,8 @@ static int mtk_adsp_mbox_startup(struct mbox_chan *chan)
>         writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_in);
>         writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_out);
>
> +       enable_irq(priv->irq);
> +
>         return 0;
>  }
>
> @@ -74,6 +77,8 @@ static void mtk_adsp_mbox_shutdown(struct mbox_chan *chan)
>  {
>         struct mtk_adsp_mbox_priv *priv = get_mtk_adsp_mbox_priv(chan->mbox);
>
> +       disable_irq(priv->irq);
> +
>         /* Clear ADSP mbox command */
>         writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_in);
>         writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_out);
> @@ -139,8 +144,10 @@ static int mtk_adsp_mbox_probe(struct platform_device *pdev)
>         if (irq < 0)
>                 return irq;
>
> +       priv->irq = irq;
>         ret = devm_request_threaded_irq(dev, irq, mtk_adsp_mbox_irq,
> -                                       mtk_adsp_mbox_isr, IRQF_TRIGGER_NONE,
> +                                       mtk_adsp_mbox_isr,
> +                                       IRQF_TRIGGER_NONE | IRQF_NO_AUTOEN,
>                                         dev_name(dev), mbox->chans);
>         if (ret < 0)
>                 return ret;
> --
> 2.54.0.545.g6539524ca2-goog
>
Applied to mailbox/for-next
Thanks
Jassi