Re: [PATCH] soc: qcom: rpmh: Fix use-after-free on timed out blocking requests

[Maulik Shah <maulik.shah@oss.qualcomm.com>]

On 02-11-2026 16:16, Abel Vesa wrote:
> rpmh_write(), rpmh_read() and the ACTIVE_ONLY path of rpmh_write_batch()
> hand a request to the RSC controller and wait for it to complete with
> wait_for_completion_timeout(). If the wait times out, they return to the
> caller, while the request is still owned by the TCS it was written to.
> For rpmh_write() and rpmh_read(), both the request and the completion
> live on the stack, while rpmh_write_batch() frees them on its way out.
>
> If the hardware completes the request after the timeout, tcs_tx_done()
> fetches the stale request from the TCS, passes it to the tracepoint and
> to rpmh_tx_done(), which then signals a completion that no longer
> exists. For reads, the response data is also written into the stale
> request first. This corrupts the stack of whatever the timed out caller
> went on to do, or freed memory. rpmh_write_batch() even documents this
> with a "Better hope they never finish" comment.
> Fix this by giving every request handed to the controller a reference
> count and by embedding the completion into the request. 

I would prefer to use BUG_ON() instead of WARN_ON() whenever timeout happens
just like downstream does rather than to handle the timeout cases.

In cases where interrupt never arrives, already HW is stuck with no way to recover,
so current implementation of having a WARN_ON() and allowing to continue to run
will eventually end up in BUG() or crash somewhere else.

Given the RPMH_TIMEOUT_MS is 10 seconds large and RPMH hardware transactions
expected to finish quick (within milli seconds), In cases where interrupts arrives but
CPU handling it after 10 seconds, there is something wrong. 

I have a series to print debug info when timeout happens at [1]
I can update WARN_ON() to BUG_ON() in v4.

[1] https://lore.kernel.org/linux-arm-msm/20260812-rpmh-timeout-debug-v1-v3-3-68c0a40dce23@oss.qualcomm.com/ <https://lore.kernel.org/linux-arm-msm/20260812-rpmh-timeout-debug-v1-v3-3-68c0a40dce23@oss.qualcomm.com/>

Thanks,
Maulik