Re: [PATCH] soc: qcom: pd-mapper: Fix singleton refcount

[Dmitry Baryshkov]

On August 21, 2024 5:59:34 AM GMT+07:00, Bjorn Andersson <quic_bjorande@xxxxxxxxxxx> wrote:
>The Qualcomm pd-mapper is a refcounted singleton, but the refcount is
>never incremented, which means the as soon as any remoteproc instance
>stops the count will hit 0.
>
>At this point the pd-mapper QMI service is stopped, leaving firmware
>without access to the PD information. Stopping any other remoteproc
>instances will result in a use-after-free, which best case manifest
>itself as a refcount underflow:
>
>  refcount_t: underflow; use-after-free.
>  WARNING: CPU: 1 PID: 354 at lib/refcount.c:87 refcount_dec_and_mutex_lock+0xc4/0x148
>  ...
>  Call trace:
>   refcount_dec_and_mutex_lock+0xc4/0x148
>   qcom_pdm_remove+0x40/0x118 [qcom_pd_mapper]
>   ...
>
>Fix this by incrementing the refcount, so that the pd-mapper is only
>torn down when the last remoteproc stops, as intended.
>
>Fixes: 1ebcde047c54 ("soc: qcom: add pd-mapper implementation")
>Signed-off-by: Bjorn Andersson <quic_bjorande@xxxxxxxxxxx>
>---
> drivers/soc/qcom/qcom_pd_mapper.c | 2 ++
> 1 file changed, 2 insertions(+)

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxx>




-- 
With best wishes
Dmitry