]> www.infradead.org Git - users/willy/linux.git/commit
soc: qcom: pd-mapper: Fix singleton refcount
authorBjorn Andersson <quic_bjorande@quicinc.com>
Tue, 20 Aug 2024 22:59:34 +0000 (15:59 -0700)
committerBjorn Andersson <andersson@kernel.org>
Wed, 21 Aug 2024 14:50:48 +0000 (09:50 -0500)
commitc158ceb826068a8bbe3c9e78df420f47ba53c8a8
tree421e505365c3067f61f57d3589cb80538d820306
parent8342009efa2a5e75dce56173d7de026bcc6666d8
soc: qcom: pd-mapper: Fix singleton refcount

The Qualcomm pd-mapper is a refcounted singleton, but the refcount is
never incremented, which means the as soon as any remoteproc instance
stops the count will hit 0.

At this point the pd-mapper QMI service is stopped, leaving firmware
without access to the PD information. Stopping any other remoteproc
instances will result in a use-after-free, which best case manifest
itself as a refcount underflow:

  refcount_t: underflow; use-after-free.
  WARNING: CPU: 1 PID: 354 at lib/refcount.c:87 refcount_dec_and_mutex_lock+0xc4/0x148
  ...
  Call trace:
   refcount_dec_and_mutex_lock+0xc4/0x148
   qcom_pdm_remove+0x40/0x118 [qcom_pd_mapper]
   ...

Fix this by incrementing the refcount, so that the pd-mapper is only
torn down when the last remoteproc stops, as intended.

Fixes: 1ebcde047c54 ("soc: qcom: add pd-mapper implementation")
Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20240820-pd-mapper-refcount-fix-v1-1-03ea65c0309b@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
drivers/soc/qcom/qcom_pd_mapper.c