From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: misc: fastrpc: Add reference counting for fastrpc_user structure Date: Fri, 27 Feb 2026 11:57:24 +1000 Message-ID: In-Reply-To: <20260226151121.818852-1-anandu.e@oss.qualcomm.com> References: <20260226151121.818852-1-anandu.e@oss.qualcomm.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Overall Series Review Subject: misc: fastrpc: Add reference counting for fastrpc_user structure Author: Anandu Krishnan E Patches: 2 Reviewed: 2026-02-27T11:57:24.514716 --- This single patch adds `kref`-based reference counting to `struct fastrpc_u= ser` to prevent a use-after-free where `fastrpc_device_release()` frees the= user structure while invoke contexts are still pending in a workqueue. The= approach is fundamentally correct =E2=80=94 each context takes a reference= on the user in `fastrpc_context_alloc()` and releases it in `fastrpc_conte= xt_free()`, ensuring the user struct outlives all its contexts. However, the patch has a **significant bug** in the placement of `kref_init= ()` in `fastrpc_device_open()`, which introduces a new race window. The ref= erence counting logic is otherwise sound =E2=80=94 the `fastrpc_channel_ctx= ` get/put accounting remains correctly balanced despite the structural chan= ges. --- Generated by Claude Code Patch Reviewer