FROMLIST: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context#562
Open
quic-anane wants to merge 2 commits into
Open
FROMLIST: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context#562quic-anane wants to merge 2 commits into
quic-anane wants to merge 2 commits into
Conversation
shashim-quic
requested changes
May 11, 2026
shashim-quic
left a comment
shashim-quic
left a comment
There was a problem hiding this comment.
Revert "FROMLIST: misc: fastrpc: Add reference counting for fastrpc_user structure"
This reverts commit 14e526a.
AS suggested offline, please mention reason of revert in commit log.
and add Link: tag in the FROMLIST commit you bringing in. |
quic-anane
force-pushed
the
refcount_fix_full
branch
from
2b9dc6e to
fab141b
Compare
added 2 commits
May 11, 2026 17:35
…ser structure" This reverts commit 14e526a. This change corresponds to the initial (v1) version shared with the upstream community. Revert it to apply the complete v3 revision, which includes additional fixes and updates not present in the earlier version. v3 version contains this changes as well. Signed-off-by: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
…eue context
There is a race between fastrpc_device_release() and the workqueue
that processes DSP responses. When the user closes the file descriptor,
fastrpc_device_release() frees the fastrpc_user structure. Concurrently,
an in-flight DSP invocation can complete and fastrpc_rpmsg_callback()
schedules context cleanup via schedule_work(&ctx->put_work). If the
workqueue runs fastrpc_context_free() in parallel with or after
fastrpc_device_release() has freed the user structure, it dereferences
the freed fastrpc_user. Depending on the state of the context at the
time of the race, any one of the following accesses can be hit:
1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf->fl->cctx, ...)
to strip the SID bits from the stored IOVA before passing the
physical address to dma_free_coherent().
2. fastrpc_free_map() reads map->fl->cctx->vmperms[0].vmid to
reconstruct the source permission bitmask needed for the
qcom_scm_assign_mem() call that returns memory from the DSP VM
back to HLOS.
3. fastrpc_free_map() acquires map->fl->lock to safely remove the
map node from the fl->maps list.
The resulting use-after-free manifests as:
pc : fastrpc_buf_free+0x38/0x80 [fastrpc]
lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc]
fastrpc_context_free+0xa8/0x1b0 [fastrpc]
fastrpc_context_put_wq+0x78/0xa0 [fastrpc]
process_one_work+0x180/0x450
worker_thread+0x26c/0x388
Add kref-based reference counting to fastrpc_user. Have each invoke
context take a reference on the user at allocation time and release it
when the context is freed. Release the initial reference in
fastrpc_device_release() at file close. Move the teardown of the user
structure — freeing pending contexts, maps, mmaps, and the channel
context reference — into the kref release callback fastrpc_user_free(),
so that it runs only when the last reference is dropped, regardless of
whether that happens at device close or after the final in-flight
context completes.
Link: https://lore.kernel.org/all/20260428073334.934358-1-anandu.e@oss.qualcomm.com/
Fixes: 6cffd79 ("misc: fastrpc: Add support for dmabuf exporter")
Cc: stable@kernel.org
Signed-off-by: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
quic-anane
force-pushed
the
refcount_fix_full
branch
from
fab141b to
f0ff382
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes in this PR
This PR contains two commits:
Revert previous patch
Reverts the earlier fastrpc_user reference counting change.
This is done to avoid carrying forward a partially updated
implementation and to ensure a clean base.
Apply latest patch (v3) from mailing list
Applies the full, updated version of the fix.
Incorporates all revisions from earlier versions.
Ensures correct ordering of:
fastrpc_user_put()
fastrpc_channel_ctx_put()
Consolidates teardown logic into fastrpc_user_free().
Fixes use-after-free scenarios in workqueue and error paths.
CRs-Fixed: 4502232