Re: [PATCH v3 2/3] soc: qcom: apr: Fix theoretical use-after-free of GPR port on concurrent RX callback

[Abel Vesa]

On 26-11-03 15:56:37, Krzysztof Kozlowski wrote:
> gpr_do_rx_callback(), executed from the RX workqueue, looks up the
> destination port in the IDR under svcs_lock, but then drops the lock to
> call port's callback.
> 
> Concurrently closing a graph calls gpr_free_port(), which frees the port
> after removing it from IDR, thus a theoretical scenario (not reproduced)
> is possible:
> 
>   CPU0 (RX worker)                  CPU1 (teardown)
>   ----------------                  ---------------
>   gpr_do_rx_callback()
>     lock(svcs_lock)
>     svc = idr_find()
>     unlock(svcs_lock)
>                                     q6apm_graph_close()
>                                       gpr_free_port()
>                                         idr_remove()
>                                         kfree(port)
>                                       kfree(graph)
>     svc->callback(..., svc->priv)   <- use-after-free
> 
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/bug/linux-1ebe255f-a874-46dc-b7cc-455e7bce402f
> Fixes: ec1471a898cc ("soc: qcom: apr: Add GPR support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxxxxxxxx>

Reviewed-by: Abel Vesa <abel.vesa@xxxxxxxxxxxxxxxx>