[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240820-pd-mapper-refcount-fix-v1-1-03ea65c0309b@quicinc.com>
Date: Tue, 20 Aug 2024 15:59:34 -0700
From: Bjorn Andersson <quic_bjorande@...cinc.com>
To: Bjorn Andersson <andersson@...nel.org>,
Konrad Dybcio
<konrad.dybcio@...aro.org>,
Chris Lew <quic_clew@...cinc.com>,
"Dmitry
Baryshkov" <dmitry.baryshkov@...aro.org>
CC: <linux-arm-msm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
"Bjorn
Andersson" <quic_bjorande@...cinc.com>
Subject: [PATCH] soc: qcom: pd-mapper: Fix singleton refcount
The Qualcomm pd-mapper is a refcounted singleton, but the refcount is
never incremented, which means the as soon as any remoteproc instance
stops the count will hit 0.
At this point the pd-mapper QMI service is stopped, leaving firmware
without access to the PD information. Stopping any other remoteproc
instances will result in a use-after-free, which best case manifest
itself as a refcount underflow:
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 354 at lib/refcount.c:87 refcount_dec_and_mutex_lock+0xc4/0x148
...
Call trace:
refcount_dec_and_mutex_lock+0xc4/0x148
qcom_pdm_remove+0x40/0x118 [qcom_pd_mapper]
...
Fix this by incrementing the refcount, so that the pd-mapper is only
torn down when the last remoteproc stops, as intended.
Fixes: 1ebcde047c54 ("soc: qcom: add pd-mapper implementation")
Signed-off-by: Bjorn Andersson <quic_bjorande@...cinc.com>
---
drivers/soc/qcom/qcom_pd_mapper.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/soc/qcom/qcom_pd_mapper.c b/drivers/soc/qcom/qcom_pd_mapper.c
index a4c007080665..d6ddf71e83bb 100644
--- a/drivers/soc/qcom/qcom_pd_mapper.c
+++ b/drivers/soc/qcom/qcom_pd_mapper.c
@@ -635,6 +635,8 @@ static int qcom_pdm_probe(struct auxiliary_device *auxdev,
ret = PTR_ERR(data);
else
__qcom_pdm_data = data;
+ } else {
+ refcount_inc(&__qcom_pdm_data->refcnt);
}
auxiliary_set_drvdata(auxdev, __qcom_pdm_data);
---
base-commit: 47ac09b91befbb6a235ab620c32af719f8208399
change-id: 20240820-pd-mapper-refcount-fix-404d290d6868
Best regards,
--
Bjorn Andersson <quic_bjorande@...cinc.com>
Powered by blists - more mailing lists