This series fixes two races in fastrpc_rpmsg_probe() that can be triggered when userspace opens a fastrpc device node concurrently with the rpmsg probe sequence.
fastrpc_device_register() calls misc_register() before the channel context is fully initialised. A concurrent open() in that window hits kref_get() on a zero refcount, and because fastrpc_cb_devices_create() has not yet run sesscount is 0, the error path calls kref_put() on the saturated refcount, triggering kfree() of the channel context. A subsequent IRQ-path fastrpc_rpmsg_callback() then dereferences the freed spinlock, causing a kernel panic. A NULL dereference in the fastrpc_device_open() error path when cctx->rpdev is concurrently cleared by fastrpc_rpmsg_remove() is also addressed. Signed-off-by: Vinayak Katoch <[email protected]> --- Changes in v2: - Add Cc: stable to both fixes - Free cctx via fastrpc_channel_ctx_put() in the probe error path - Clear rpdev and wake pending users there, as remove() does - Move fastrpc_notify_users() above probe - Link to v1: https://lore.kernel.org/r/[email protected] --- Vinayak Katoch (2): misc: fastrpc: fix NULL rpdev dereference when session alloc fails misc: fastrpc: fix init ordering race in rpmsg probe drivers/misc/fastrpc.c | 95 +++++++++++++++++++++++++++++--------------------- 1 file changed, 56 insertions(+), 39 deletions(-) --- base-commit: 8f7df005a7564bd7ffa75da9c3085d5b996f1e16 change-id: 20260923-fastrpc-probe-fixes-30c1980b50e6 prerequisite-change-id: 20260609-dup-sessions-ea2acaac1994:v6 prerequisite-patch-id: c8b4a3873f9cf0d69beff0f608933ae83faa4c47 prerequisite-patch-id: 05d9299adf4184e0e56d97dc063ab5bf227cc5a5 prerequisite-patch-id: da0a3d55397a522ea4b77769e387df9faea8e024 Best regards, -- Vinayak Katoch <[email protected]>
