[PATCH v2 0/2] misc: fastrpc: context lifetime fixes on the glink response path

[PATCH v2 0/2] misc: fastrpc: context lifetime fixes on the glink response path

[bo cao]

This is the public follow-up to the report "fastrpc: use-after-free
of fastrpc_invoke_ctx on duplicate glink responses in
fastrpc_rpmsg_callback()" (source analysis of v7.3-rc5 and current
master), incorporating feedback from Greg KH on the originally
proposed single patch:

  - split into two independent fixes, each with its own Fixes tag;
  - the atomic bitop and flag bitfield are replaced by a plain bool
    checked under cctx->lock, together with the sequence validation;
  - brace and comment style fixed;
  - kref_get_unless_zero() at the lookup is kept: the lock protects
    the IDR but not the context lifetime, since the final kref_put()
    runs outside the lock and fastrpc_context_free() removes the
    context from ctx_idr only after releasing its maps and DMA
    buffer, so "found in the IDR" does not imply "refcount > 0".

Patch 1 pins the context found by idr_find() before dropping
cctx->lock and runs the sequence validation inside the critical
section.  Patch 2 makes the response path one-shot so a duplicate
response cannot consume the in-flight reference a second time.

No runtime reproducer is included: triggering requires a second
COMPLETE response for a live context, i.e. a buggy or hostile DSP,
which cannot be produced from the ARM side on stock firmware.  The
sequence check added by 96e62cc0a84d already addresses the same
class of misbehaving remote responses (the recycled-IDR-slot case);
these patches close the remaining cases (duplicate delivery for the
same context, and the unlocked use against a concurrent context
free).

v2 is a resend of the two patches previously sent as two separate
emails, now properly threaded as a series with git send-email.  No
code changes.

bo cao (2):
  misc: fastrpc: pin invoke context at glink response lookup
  misc: fastrpc: consume in-flight reference exactly once

 drivers/misc/fastrpc.c | 40 ++++++++++++++++++++++++++++++++--------
 1 file changed, 32 insertions(+), 8 deletions(-)

-- 
2.39.5 (Apple Git-154)