On August 21, 2024 5:59:34 AM GMT+07:00, Bjorn Andersson <quic_bjorande@xxxxxxxxxxx> wrote:
>The Qualcomm pd-mapper is a refcounted singleton, but the refcount is
>never incremented, which means the as soon as any remoteproc instance
>stops the count will hit 0.
>
>At this point the pd-mapper QMI service is stopped, leaving firmware
>without access to the PD information. Stopping any other remoteproc
>instances will result in a use-after-free, which best case manifest
>itself as a refcount underflow:
>
> refcount_t: underflow; use-after-free.
> WARNING: CPU: 1 PID: 354 at lib/refcount.c:87 refcount_dec_and_mutex_lock+0xc4/0x148
> ...
> Call trace:
> refcount_dec_and_mutex_lock+0xc4/0x148
> qcom_pdm_remove+0x40/0x118 [qcom_pd_mapper]
> ...
>
>Fix this by incrementing the refcount, so that the pd-mapper is only
>torn down when the last remoteproc stops, as intended.
>
>Fixes: 1ebcde047c54 ("soc: qcom: add pd-mapper implementation")
>Signed-off-by: Bjorn Andersson <quic_bjorande@xxxxxxxxxxx>
>---
> drivers/soc/qcom/qcom_pd_mapper.c | 2 ++
> 1 file changed, 2 insertions(+)
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxx>
--
With best wishes
Dmitry
