From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C74D0315D43 for ; Thu, 9 Apr 2026 06:26:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775715999; cv=none; b=fdK3GCKXrd/StHvJvjhDwfL76p6kwlxFdylr98sMii3xkkOv3rjBXANqL1LhYcKq26hnvGwDaoprhJRXVl4Yx2wFkRwv7z3BDZNhjYbUqiwDCSQq2E+b8/cct4IvE3LFf72uWxuDBYWXttEh8U1P+Qjrz9UN/tN2kQEKyDgH5Mc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775715999; c=relaxed/simple; bh=z6vbDo0OkzuQGNRRmVefXteFHpfMXlyyWBpHr+UoyQM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=khYjN818JmKufAV+ABosNcxa0/kNu47C4HPxFcTMBLDnZARXCMMxuH8iacva08d3/0NTkdKZSmAUyWRjOsakT2jKqvBdEm3FmnLjODpJePAnHpuvzpoq0amOnq1YWco1shd7u+/pVk6/7EYZXMCUbUATYUfgMbd64/AsCA2W2+0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=awwcLrJt; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=RJjLpAsP; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="awwcLrJt"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="RJjLpAsP" Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 638NQf2h4049335 for ; Thu, 9 Apr 2026 06:26:36 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=pX4/CzTEsQ9 azlafCB2t1IsspVCg3AMoDjZdlkJJoE4=; b=awwcLrJtHXQ5tfoHcotTtyGJOSD 0MeLxKwccPj+SJ06MoxJ8ZK1K938h61GWnCehkSek+qUwHMrc6phwRSg7wEc89L8 mFNeo3JSVqk5E/QxBjHFcKkNTnPj/AoLKpHEKZFPy5l8WgPsB4Rifo1ixZ75X7P2 2U0I11c81EkV3DuHbAPN62L5WhlbG/hD8Vs5+H81h5g8BMyANOKG1T71AbgohLbb u7PUi/TrP1uIMzAszl4Pn7OxSfehD7xCvyd5xLpBi+MyFuLFb9XfbUWZxOPH8s5V VHO+9B7eyRg/tY943OGRzHz1X1F6atcUbHKGTymz8LSx9TeAweoQuctj7bg== Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4ddtd72qfg-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 09 Apr 2026 06:26:35 +0000 (GMT) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2b24e45271cso8571065ad.2 for ; Wed, 08 Apr 2026 23:26:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1775715995; x=1776320795; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=pX4/CzTEsQ9azlafCB2t1IsspVCg3AMoDjZdlkJJoE4=; b=RJjLpAsPV0D52+wfCCpU4bGpWzqzqiNtpVGW/GsuGNNplUW9jhKmTa9ny1trKT06Hl NdOABvQu98+4noJ5u6ns2xNdlDRIg+ygHc06V5P9mnKCRShFH1Ft+kZ3RZwGLmcMJW0u zvie6WaC2NzvlpGaANcpw6mlwAS/U7XdDGOjkM+1f6wr1upqA66iQcj16YlsP5Yz5qid 6c1JBOq9LkOsMAXjd8FIIG3Qke5bSRvrtop+TLEXy3lNR/wQK2aBRe1SaSeGD4z284jd Jm7FGwgNLet3+FZzW/l92pULOM/xdRM05yFhVofZDZXltu/6mABFaQiTOkKxuaNmAb83 pDlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775715995; x=1776320795; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=pX4/CzTEsQ9azlafCB2t1IsspVCg3AMoDjZdlkJJoE4=; b=PTGGcDKrj+DeuZwMRVd3FUbdTnI42LOrSHjoi3JZGl7YMbvqK8oY7cBfekGrta3hnu ZKr+MqGqZvut+yDm9BGTMTF5KM64AaTFpgWL+gq/adqAy6Sp8je6+zz67c5zpwyRW/iT I8OACx9OI7BSE8a9Z2KgvUBMynn2smRWhy/oKp6EnJqolOgTxmuPMIIhhuv2pui5k5X4 HELSv3nxFPGGIDi1sg9L6Zmmhntk9NkIMspbp2bf7c7a1vnUkBHAgN1awIEvZB4z3dhj aVEYJAPSDlpr3rBvT1kllg2iRgWkt5PaZB4+WaFdtPhfZYhCgJjsp9IZ1t2KHU5wGvyU G7AQ== X-Forwarded-Encrypted: i=1; AJvYcCURnMSpFi/c9cA2i64oke/6ZXfEV4SQDM6RJWy8AVrWBMqIzTndEKBwI/b82iVDDoxDSb/8F9aKyI5yIfQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzlAvYyW+gVxgec1noH6s2JLBZrbkVaGiYCWOpy/BaIuEkONOl0 8qWde3wDhfT9CoqqxD0ZPY+69LRAEdAN409xiggqPtZKI7iVN1RlHALs/jcbm1jlx1PhRSj7Drk z/o1NSCYldkx4bJNi4P3G1m1f3PXlhHk5lTh7T6koUiwqUbAboqL432DKJE1E1ARcylly0o0C7j fBwQ== X-Gm-Gg: AeBDieuWMCYqSdCTfzUe0r7/R76JSftiyHvoBzICs9yMT1dJOT2gadoLxmrInBSfaLM QnyP7F2+TqYRahMkq47nQzixL7FYkQUZUkughXVA9FdXGOg7OIeBLNfqP+x6Sj7iaKo8TqHDzCn tIaRaaLydJk6hbjzJp745PM8zdz96Q34qEn/euwTJ6wjUWtJfQjCWJCT2kkBNWGuB26zgRVtYsV E9ohh6O4+zHSsWAXQO2w6gy/A4IdNYVkV4wIh8UGjzx0NKgmQL+xUVfhIo3v6pPh3jn4KRaK3Na jnvvJPQ5fy2paHfRRjBPNGRFN1DA1kfiDBwstjHVPnwXTjvjHj+sLL9e79u4+r/viBqtmqzdpw+ JJ8+NdXcYqgmOMXWay5lyaZuMtPJCuGdpKDU7k9/fylzsNTC3Yk57c4OObx6UzwDzBjCahn0Cwb vZYFq2FIW0wsffsFLnbw== X-Received: by 2002:a17:902:da83:b0:2ae:5163:c2aa with SMTP id d9443c01a7336-2b2817add40mr242580465ad.20.1775715994553; Wed, 08 Apr 2026 23:26:34 -0700 (PDT) X-Received: by 2002:a17:902:da83:b0:2ae:5163:c2aa with SMTP id d9443c01a7336-2b2817add40mr242580075ad.20.1775715994073; Wed, 08 Apr 2026 23:26:34 -0700 (PDT) Received: from QCOM-SocCW5bzXR.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b2749cbd4dsm220786795ad.76.2026.04.08.23.26.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Apr 2026 23:26:33 -0700 (PDT) From: Jianping Li To: Srinivas Kandagatla , Amol Maheshwari Cc: Arnd Bergmann , Greg Kroah-Hartman , Abel Vesa , Jorge Ramirez-Ortiz , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, ekansh.gupta@oss.qualcomm.com, quic_chennak@quicinc.com, stable@kernel.org, Jianping Li Subject: [PATCH v4 2/4] misc: fastrpc: Remove buffer from list prior to unmap operation Date: Thu, 9 Apr 2026 14:26:15 +0800 Message-Id: <20260409062617.1182-3-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260409062617.1182-1-jianping.li@oss.qualcomm.com> References: <20260409062617.1182-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Authority-Analysis: v=2.4 cv=QoRuG1yd c=1 sm=1 tr=0 ts=69d7469b cx=c_pps a=IZJwPbhc+fLeJZngyXXI0A==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yx91gb_oNiZeI1HMLzn7:22 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=ZnmZ8TzD_GdZzTgawW0A:9 a=uG9DUKGECoFWVXl0Dc02:22 X-Proofpoint-ORIG-GUID: MullBq2xl_vTZ2A4hhbIlCK4B7QSpB-c X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDA5MDA1NSBTYWx0ZWRfX2jRtfJSjYScn J1NPzUcF+VY/SYAriLair7nCuJBNgknrYxj0h1m9I7wXL8lHnoONCTE/MrFo2dsGYNdZiNK367y UXPNa8Df2J2tLZjAqk0A+yirLTJiMYxew/MhjvdWpv27ugJ76BQIiYb4bqZDYL6/60ZN/MaDFqg RGFjgV/KO7zI2MV5iqXQssmMQe6vQ9I1lHTKv3zDm+LLP5gDpazptmAfmt8cNguNQRvOSSF+DVG NCq7KVXubcsKvcT7AdOgxH5fNz5m6uv7Rt0Yr2C20V7dWXX1XshrU8kMTH2l2SI4r9F56v8WCiQ eZ//enH3IAX3yf1VrEDpkjU1zTgwoXcGaGb9Q912UPLqJNcHakgXxNl55m3PcL1Uf3Z8uwAoM8D XtOaJ8VpivORwx+liD56yqYCS02FKFGnwtUXIk0jGnFcFoV2EGsPYIXhARelqytVrEKHc+XhqSN yKSn00IJUbpQs3MsSsg== X-Proofpoint-GUID: MullBq2xl_vTZ2A4hhbIlCK4B7QSpB-c X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-09_01,2026-04-08_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 impostorscore=0 lowpriorityscore=0 suspectscore=0 priorityscore=1501 adultscore=0 malwarescore=0 phishscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2604010000 definitions=main-2604090055 From: Ekansh Gupta fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if any other thread removes the entry from list while unmap operation is ongoing. Remove the entry before calling unmap operation. Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index b87a5f97c96f..148085c3b61a 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1862,9 +1862,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_buf * &args[0]); if (!err) { dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); - spin_lock(&fl->lock); - list_del(&buf->node); - spin_unlock(&fl->lock); fastrpc_buf_free(buf); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); @@ -1878,6 +1875,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) struct fastrpc_buf *buf = NULL, *iter, *b; struct fastrpc_req_munmap req; struct device *dev = fl->sctx->dev; + int err; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1885,6 +1883,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) spin_lock(&fl->lock); list_for_each_entry_safe(iter, b, &fl->mmaps, node) { if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) { + list_del(&iter->node); buf = iter; break; } @@ -1897,7 +1896,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) return -EINVAL; } - return fastrpc_req_munmap_impl(fl, buf); + err = fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); + } + + return err; } static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) @@ -1988,14 +1994,17 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) if (copy_to_user((void __user *)argp, &req, sizeof(req))) { err = -EFAULT; - goto err_assign; + goto err_copy; } dev_dbg(dev, "mmap\t\tpt 0x%09lx OK [len 0x%08llx]\n", buf->raddr, buf->size); return 0; - +err_copy: + spin_lock(&fl->lock); + list_del(&buf->node); + spin_unlock(&fl->lock); err_assign: fastrpc_req_munmap_impl(fl, buf); -- 2.43.0