Claude review: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
Author: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
Patches: 1
Reviewed: 2026-04-30T10:52:17.356682

---

This single-patch series adds kref-based reference counting to `fastrpc_user` to fix a real use-after-free race: when a user closes the file descriptor while a DSP invocation is still in flight, `fastrpc_device_release()` frees the `fastrpc_user` structure, and then the workqueue-scheduled `fastrpc_context_free()` dereferences the freed user through `ctx->fl`. The approach — have each invoke context take a user reference at allocation and release it at context free — is correct in principle and follows the existing kref pattern already used for `fastrpc_channel_ctx` and `fastrpc_invoke_ctx`.

However, the patch has two bugs: a **kref initialization ordering issue** and, more seriously, a **use-after-free on the pending context list** in the new `fastrpc_user_free()`. The latter is a direct consequence of moving the pending-list cleanup into the kref release callback without accounting for the fact that contexts freed via the workqueue path are `kfree()`'d without being removed from `fl->pending`. The result is that `fastrpc_user_free()` iterates a list containing already-freed entries — trading one UAF for another.

The fix is close but needs another revision to address these issues before it can be merged.

---

---
Generated by Claude Code Patch Reviewer