Re: [PATCH 1/2] misc: fastrpc: pin invoke context at glink response lookup

[Greg KH]

On Fri, Oct 30, 2026 at 04:19:55PM +0800, bo cao wrote:
> fastrpc_rpmsg_callback() looks up the invoke context under cctx->lock
> but then uses it after dropping the lock, including the ctxid read in
> the sequence validation itself, ctx->retval, complete() and
> schedule_work().
> 
> The final kref_put() happens outside the lock (in the invoking
> thread's bail path or in the put_work worker) and
> fastrpc_context_free() removes the context from ctx_idr only after
> releasing its maps and DMA buffer, so a context found in the IDR may
> already have a zero refcount with free in progress:
> 
>     callback                          freeing thread
>     --------                          --------------
>     lock; idr_find() -> ctx; unlock
>                                       (refcount already 0; free is
>                                        releasing maps and buf)
>                                       lock; idr_remove(); unlock
>                                       kfree(ctx)
>     read ctx->ctxid for the seq
>     check -- use after free
> 
> Take a reference on the context inside the same critical section as
> the idr_find() lookup and run the sequence validation there too;
> drop the reference after scheduling the worker (or when the response
> is dropped).  kref_get_unless_zero() is required because the IDR may
> still hold a context whose refcount has already reached zero while
> fastrpc_context_free() is running.
> 
> Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: bo cao <treebacker@xxxxxxxxxxx>
> ---
>  drivers/misc/fastrpc.c | 24 ++++++++++++++++--------
>  1 file changed, 16 insertions(+), 8 deletions(-)

These two messages are not "threaded" properly, sent as 2 separate
emails.  Is that intentional?  It breaks our tooling :(

Please use something like 'git send-email' or 'b4' for sending patches
out, that's what those tools were written for.

thanks,

greg k-h