From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f171.google.com (mail-yw1-f171.google.com [209.85.128.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EE486331EBC for ; Wed, 24 Jun 2026 18:55:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782327315; cv=none; b=ALqq7Ejv1KJ7hUN29ISo0ipozhRPHBIjr4O8S7mklXPoGRCPYvN5K6CONIY3Yaq1i6U1wra5X7uPdWNA5R0B399uNwL08XfnZy8r09eK2Lb9hH2kRxuzssTWY4LwsXZJLpaUjP6i4/O0p7hysOBDqM8Bogqi7KmUA0hcictpuI4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782327315; c=relaxed/simple; bh=Q3CnFFs9ChJTjG3+XxXkpaVpvorugGv4uTTNtQEh0ao=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=lYPhGAI3znRHXaaKbW23r6G/JF7g/iqm8zGBSXev7w9jKU24t7e/DUjQc/HIvx9kdGhAFKIFMm9wOVKSK6kerKuTFwwScHJykYy8SsBIfl6oDHeb9Wu3WGs9CT3zz7qCGpcyCeFEqz3SaXdldwhOCGJmxiiPs1M6b4W046qukos= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Jk8FOC5c; arc=none smtp.client-ip=209.85.128.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Jk8FOC5c" Received: by mail-yw1-f171.google.com with SMTP id 00721157ae682-809ee64a490so5917707b3.0 for ; Wed, 24 Jun 2026 11:55:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782327313; x=1782932113; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=7YgHnl2lJKwXfRhDrg0bud/BfHOtjapxwR6hn+EBYNI=; b=Jk8FOC5csTxTuuSDWZxBBYLK8DTyAkNsNoiWLocfgyag8BlqZNtzYm6QPSCqW92WYe fCQvow/9IezLw8g3JUjSunseZaKO60U5Ctcv+1e/QlP6DfoT9fCXQhza0HYf0SMWiOvy KEo6o2rLZBhJHKA+BR3O+kvqNSl0N7tZ4P0eEOO3tv/M0SljHw/kW+sCjwptxOnXwE9T kF6xUXp37XAyimZtvYzO/+B2E2m6dLg9omwmZase9qNeyoxHDpK9UGLih+xpT60ZJac+ Go4azMoElheV+BSHXvjZ+KwldM8aIZX5liccKItwZthho+mfocDu5uLAu7ZfOTbOnkgu g/aQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782327313; x=1782932113; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=7YgHnl2lJKwXfRhDrg0bud/BfHOtjapxwR6hn+EBYNI=; b=A6M5sZuZF083tEzhKnkqhPZJpKk+HPisTSwTh7Mhd0eBijL8IosBd1ejF7RVQLHCzM vHtRSUeDS09OP0pJXAggphSgEPeFFOtqKodc1PwtheUAf+itZ+EEi2ei0kYnOeHwNh7z 1L25qw4kHpr9T6uN2fjOsdD0gn+0dFX81snRxZbdzAB6puTo7wH1qWPH7VoNGPDjxowt rR8/CQPzjCMP8HanZPwgQH8OtiUX06UZBCb+OQAt0LK+IUowSEZ1rF42SahpOimtduFz gWm7weBe0ETa1sHqKe3wgtWo+v8j1FHcbTismkyPjg+Q3elPXZCAqEspaCsKfPL3G4OL 80Gg== X-Forwarded-Encrypted: i=1; AHgh+RpWm2ynuRXeiNIH+m0yGA0gUBrbzbgVCX+ItCiTiQKX2is0h/oiGLWZem8j9/TmGhN0uOfuSVkyxmISVmE=@vger.kernel.org X-Gm-Message-State: AOJu0YytSGs9yyjAmGndJPn8Hh10DoZZJO4kQGzy8dkHNiVMHVi9JTv7 G+h8b31/qbnj0bl8/+2mK80iym3PIzKUMcuFCIyGEr3JWbOQrqVAgs+4 X-Gm-Gg: AfdE7cllvpckgzit4mDufNWX5bSwz0mLYRMorfj+uuMQRHlzk6f4iK5fnK/dFPOMKH+ P6U/sTHFWeon6oMrL1XePuLiDTwgpiuODqjogIEm48VjEazG/CCSjsVfWT38C0JKZV3Oa/VhbJr yInu/dJ/g0SAI8ld7JItLlDlOH9k2TyivU4WiH9dMUl4cezPV7h/K/kjCVeER8RPo/Pjdr04r/3 +e1DoKuXaHBN3gVBc/XthnMmVRu1AclV32Fvp/SRbFRjeqoCWpQ/dJfFDW5nytZV5be/vjQTIkC IfdKqbUDK+JB9XcNXgRwiNvJLam3MRaSv7AyuZPJaNyR//JEy3uQ7Yn4Fonfkd7ysDNA5+83yzq bvbkspWqZySc/7DhpxcYjztZU8hUVBpGDYPw8oFMNbv7crFz8/UEI4XdKVQ4r2JCdo4ZKDAOMdo WIjGnkK1vFiHqRuJUvbaJw48Xc4g== X-Received: by 2002:a05:690c:e241:20b0:809:9422:8c47 with SMTP id 00721157ae682-80994228e31mr20933047b3.22.1782327313072; Wed, 24 Jun 2026 11:55:13 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id 00721157ae682-8025ffc2730sm61645687b3.34.2026.06.24.11.55.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 24 Jun 2026 11:55:12 -0700 (PDT) From: Yousef Alhouseen To: Srinivas Kandagatla , Amol Maheshwari Cc: Arnd Bergmann , Greg Kroah-Hartman , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yousef Alhouseen Subject: [PATCH] misc: fastrpc: initialize invoke refcount before publish Date: Wed, 24 Jun 2026 20:54:27 +0200 Message-ID: <20260624185427.1451-1-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit fastrpc_context_alloc() adds a new invoke context to the pending list and the channel IDR before initializing its refcount. A racing DSP response can find that context by ID and drop a reference before kref_init() has run. Initialize the refcount before publishing the context. Signed-off-by: Yousef Alhouseen --- drivers/misc/fastrpc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 6ced210ca..42fc128e1 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -703,6 +703,7 @@ static struct fastrpc_invoke_ctx *fastrpc_context_alloc( ctx->cctx = cctx; init_completion(&ctx->work); INIT_WORK(&ctx->put_work, fastrpc_context_put_wq); + kref_init(&ctx->refcount); spin_lock(&user->lock); list_add_tail(&ctx->node, &user->pending); @@ -718,8 +719,6 @@ static struct fastrpc_invoke_ctx *fastrpc_context_alloc( ctx->ctxid = ret << 4; spin_unlock_irqrestore(&cctx->lock, flags); - kref_init(&ctx->refcount); - return ctx; err_idr: spin_lock(&user->lock); -- 2.54.0