Re: [PATCH v10 07/24] firmware: arm_scmi: Add support to parse SHMTIs areas

[Fayssal Benmlih]

Hi Cristian,

The UUID pointer copy and nonzero initial capacity are fixed in V10.
Two related lifetime and overflow issues appear to remain.

In scmi_telemetry_uuids_update(), both:

        ti->uuids_len * 2

and the following:

        ti->uuids_len *= 2;

can wrap before the allocation or stored capacity is updated. The initial
ti->num_shmti * 2 calculation has the same issue. Please use checked
multiplication and reject an unrepresentable capacity.

There is also still a race between scmi_telemetry_line_get() and
scmi_telemetry_line_put().

line_get() loads the XArray entry under lines_mtx, releases the mutex, and
only then increments the refcount. line_put() decrements the refcount before
taking lines_mtx to erase the entry. A concurrent put can therefore reach
zero after the lookup but before the increment, and then erase and free the
object.

Please increment the reference while protected by the same lifetime lock,
or use refcount_inc_not_zero() with an appropriate XArray/RCU scheme. The
zero transition, erase, and free must also be coordinated with lookup.

Thanks,
Fayçal