On 07-10-2026 14:14, Jianping Li wrote:
> fastrpc_device_register() calls misc_register(), which immediately makes
> /dev/fastrpc-<domain> visible to userspace. However, kref_init() on the
> channel context refcount only runs after the whole domain switch()
> completes, several statements later.
>
> Any process that opens the device in that window reaches
> fastrpc_device_open() -> fastrpc_channel_ctx_get() -> kref_get() on a
> refcount that has never been initialised and is still zero, which
> refcount_t correctly reports as a use-after-free:
>
> refcount_t: addition on 0; use-after-free.
> WARNING: CPU: 0 PID: 760 at lib/refcount.c:25
> refcount_warn_saturate+0x120/0x144
> CPU: 0 UID: 0 PID: 760 Comm: adsprpcd
> Call trace:
> refcount_warn_saturate
> fastrpc_device_open [fastrpc]
> misc_open
> chrdev_open
> do_dentry_open
> vfs_open
> path_openat
> do_filp_open
> do_sys_openat2
> __arm64_sys_openat
>
> This is easy to hit after a subsystem restart, when the DSP daemon
> reopens the device as soon as it observes the PD coming back up, racing
> with fastrpc_rpmsg_probe() on the rebind path.
>
> Move kref_init() ahead of the device registration so the refcount is
> always valid by the time the node is reachable from userspace.
>
> Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver model")
> Signed-off-by: Jianping Li <[email protected]>
> ---
> drivers/misc/fastrpc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> index af18ff1992ee..05b2e7e4ad3b 100644
> --- a/drivers/misc/fastrpc.c
> +++ b/drivers/misc/fastrpc.c
> @@ -2599,6 +2599,7 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device
> *rpdev)
> data->poll_mode_supported = soc_data->poll_mode_supported ||
> of_machine_get_match(fastrpc_poll_supported_machines);
>
> + kref_init(&data->refcount);
Need to move all initialization before fastrpc_device_register(), this
is already being handled by this patch[1].
[1]
https://lore.kernel.org/all/[email protected]/>
switch (domain_id) {
> case ADSP_DOMAIN_ID:
> case MDSP_DOMAIN_ID:
> @@ -2626,7 +2627,6 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device
> *rpdev)
> goto err_free_data;
> }
>
> - kref_init(&data->refcount);
> atomic_set(&data->ctx_seq, 0);
>
> rdev->dma_mask = &data->dma_mask;
