Hi Dinesh,
On Tue, 30 Jun 2026 14:55:17 +0800, [email protected] wrote:
diff --git a/arch/arm/mach-socfpga/mailbox_s10.c
b/arch/arm/mach-socfpga/mailbox_s10.c
@@ -393,0 +428,14 @@ error:
+ (u32 *)resp_buf);
+#endif
+}
+
+int mbox_rsu_status(u32 *resp_buf, u32 resp_buf_len)
+{
+ int ret;
+ struct rsu_status_info *info = (struct rsu_status_info *)resp_buf;
+
+ info->retry_counter = -1;
+
+#if !defined(CONFIG_XPL_BUILD) && defined(CONFIG_SPL_ATF)
+ ret = smc_send_mailbox(MBOX_RSU_STATUS, 0, NULL, 0,
+ (u32 *)&resp_buf_len, (u32 *)resp_buf);
mbox_rsu_status writes the status struct before checking buffer length
(PSCI sibling already guards it).
Non-secure mbox_rsu_status() casts resp_buf to struct rsu_status_info
and assigns info->retry_counter = -1 with no NULL or resp_buf_len check.
The PSCI variant only does that write when resp_buf_len >= 9. In-tree
callers pass sizeof(struct)/4, so this is not an in-tree overflow today,
but the two paths disagree and any shorter buffer is a write past the
end of the object.
Please: Share one helper: if (!resp_buf || resp_buf_len <
sizeof(*info)/4) return -EINVAL; then set the sentinel.
[...]
Fix the SPL panic and MMC fallback before v2. Mailbox length check and
SPI redundant-env offset should ship in the same respin.
Style/checkpatch warnings are not merge-blocking.
Best regards,
Tien Fong
