Re: [PATCH 0/2] firmware: stratix10-svc: fix kaddr dangling pointers and populate kaddr1

[NG, ADRIAN HO YIN]

On 9/3/2026 12:31 AM, Dinh Nguyen wrote:
> On 5/26/26 15:35, Adrian Ng Ho Yin wrote:
> > kaddr1/2/3 in the stratix10 service layer are set to addresses of local
> > arm_smccc_res fields that go out of scope when the setting function 
> > returns,
> > leaving dangling pointers in the callback data.
> >
> > Patch 1 fixes this by adding a1/a2/a3 scratch fields to struct
> > stratix10_svc_cb_data, which lives for the SVC thread lifetime, and
> > pointing kaddrN to those fields instead of the stack.
> >
> > Patch 2 uses the same mechanism to populate the previously unset 
> > kaddr1 in
> > svc_thread_cmd_config_status(), exposing firmware status details to 
> > callers.
> >
> > Adrian Ng Ho Yin (2):
> >    firmware: stratix10-svc: fix dangling kaddr pointers in callback data
> >    firmware: stratix10-svc: populate kaddr1 from config status response
> >
> >   drivers/firmware/stratix10-svc.c              | 45 ++++++++++++-------
> >   .../firmware/intel/stratix10-svc-client.h     | 17 +++++++
> >   2 files changed, 47 insertions(+), 15 deletions(-)
>
> Do these patches need to get backport into a stable release? If so, 
> please add the appropriated Fixes tag.
>
> Thanks,
> Dinh
Hi Dinh,

The callbacks run while arm_smccc_res is still on the stack, and the
current clients copy kaddr* during the callback. They do not keep those
pointers afterwards, so this is not a stable bug.

I am dropping patch 1 for that reason. v2 will be only the kaddr1
populate on the config-status completed path, using &res.a1 like the
existing error path. That is a small feature, not a regression fix.

Thanks,
Adrian