From: Yuvan Shen apple_smc_get_key_info() releases the SMC mutex when apple_smc_cmd() returns, and only then copies the reply out of the shared memory buffer. A command issued by another thread in between can overwrite the buffer, so the key's size, type and flags can come from a different reply. The hwmon and power sub-devices call it from their probe functions, while the other sub-devices may already be issuing commands. Hold the mutex until the reply has been copied, as apple_smc_read() and apple_smc_write() do. Fixes: e038d985c982 ("mfd: Add Apple Silicon System Management Controller") Cc: stable@vger.kernel.org Signed-off-by: Yuvan Shen --- drivers/mfd/macsmc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mfd/macsmc.c b/drivers/mfd/macsmc.c index 514cba7dc897..4dbaacc7eb3d 100644 --- a/drivers/mfd/macsmc.c +++ b/drivers/mfd/macsmc.c @@ -210,7 +210,9 @@ int apple_smc_get_key_info(struct apple_smc *smc, smc_key key, struct apple_smc_ u8 key_info[6]; int ret; - ret = apple_smc_cmd(smc, SMC_MSG_GET_KEY_INFO, key, 0, 0, NULL); + guard(mutex)(&smc->mutex); + + ret = apple_smc_cmd_locked(smc, SMC_MSG_GET_KEY_INFO, key, 0, 0, NULL); if (ret >= 0 && info) { memcpy_fromio(key_info, smc->shmem.iomem, sizeof(key_info)); info->size = key_info[0]; --- base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3 change-id: 20261101-upstream-macsmc-key-info-714c15af3652 Best regards, -- Yuvan Shen