From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7DDE1427A for ; Fri, 15 May 2026 12:42:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778848964; cv=none; b=Zhu+X7okrbiu1LjgGvsBplvbprcrVeboH1G/imTCOwE0PweLWAaSCbeOxmpqMOo3SCzkMtEb/2lMyJQvLBaiYF48p1Ae1ThyeDOhN5YSeKmDmPpLQj6mWDry+eOdZLpYhcX6A2sOQ/ZrCNly0tP0gRrU1848MxUnhmaL5RMci4o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778848964; c=relaxed/simple; bh=B5X3IHqMv3RqkYzDSDwFq4aExehCiMVP6Uc3J+3VUZo=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=kFiA+KCApgriPJMW5yl84Mapqm3ynvNr9wCbE7wU1LAdlFa0mmAL0kbJgdbsf5U1iEb4VS6P8+lU+h1kNDD4ZgzV/ZhQKsIknLs5vJnUfumdOiw/v8tfP2dAfpfQWkrwg7JB0++ceCgUr7bBIDhrZ6bSKflV7VjwQF8jI1PyuUU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=gqvvgGEv; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=DlVHA3OV; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="gqvvgGEv"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="DlVHA3OV" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64FBq5od3512838 for ; Fri, 15 May 2026 12:42:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=qVx3dP68cn2 vag91UBEub6zPiFFjytB60mI7WrNd8p0=; b=gqvvgGEvQH8OtqlE2V3ymt9iJJc QcAIX9x+IlqWg42sQJ6tIclOSrU51vVsc+hCH3kWOnAe7PWdW8A19jq0gvSGOyZx DnelgxEmGBvGyTMooy54xHhvvRMGCSmFLa1lPL9vkBOLL5F6ZH/UbAMpJd/gUhhV zYcf/GOzADOmBd2zoy1dkpNX6BP83OFn4IzVotOcRW+rcvuEsVeBQsyUcLcdZOuo tbYDjbf2Ht5shZD0APfni/c2MEnY+H8PhPIQKlo1yE+WtbWxGOMTvQn0PKpYt3Fj 0Nd6WcT8Eq3HTW3BVfN/FaXkBA9jC7O68qznUiAcWzcJxFO0d9bHgqvajkA== Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4e5m1vb8v1-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 15 May 2026 12:42:41 +0000 (GMT) Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-3662eec51e0so5286306a91.3 for ; Fri, 15 May 2026 05:42:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1778848961; x=1779453761; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=qVx3dP68cn2vag91UBEub6zPiFFjytB60mI7WrNd8p0=; b=DlVHA3OVxc9koD3d/1ulQPNVqIGIpWC8LX6NG8octsidz2LtTXHwAwyNOVwMVmnvvd 9US31VuL9yrXtdsGYQJLn7Wo7zMK2YB0mE9WIyzTrI9U+XTq6f3b1H21c60wZdZcvUV1 dCwc9sGh+GJe+asst6TL4DJVXIVwIUwCKJ5bjDVQEpGW4mDjhbc+C+/tHi2bq6pHIbej wTJwKKLXbFNw+pkrHe5Gr9rT+GONjB7mt13/o6ALUknsdg0OGvVKDVh13Be24aJcuLVE VYD94keyASK3W+tC7r+t+NEW7PwS3D3Z1OQx2e3tYO01AMfP2QVnYn7aKOSjRh5pViM5 YgwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778848961; x=1779453761; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=qVx3dP68cn2vag91UBEub6zPiFFjytB60mI7WrNd8p0=; b=cXml1p18PtJpNbn7Q3Rs8X0B/J6fUxLAx6C+ygjtGScBn1iClGcfQzUiOY1JSHeYPV CG8sAT9hcV3gp0vdrha6GQ6q+5f+JwXVgJlJihPCYDcMVAlVGdkY+We4W+r5B9g76sOS V0+JEMI3OR9W4saK+sU2waF1eF7lMXD4sLiMoUQzTR0V49OJ+1FgCg42a0ddAk1nlLj6 5YXeHsDJjVtXH1pn/CRWz7PfsHtb3B7Byud7qiBVmjnGc6yKo1rNtiG32hRJgBURkklL kimJuzEUua4qMim8tuNEqTqffjJWX+7941qV5q+3/yIlWq+BzJk9FBhnTVbzJ+uVeww9 D0pQ== X-Forwarded-Encrypted: i=1; AFNElJ8iDbhBJxhUodgmL5TKE5k6Jmf8J7MfwgzbRFh9W6twO0jbrfIlcYtz9iPshBlBSVYI0PiT68PB5kRg9B4=@vger.kernel.org X-Gm-Message-State: AOJu0YyL41p5tYz5aG8sj1AebkD0RQOhLbTNtMOSLZgYC4eti4gZE3CZ cyXQy4UM5NFN3LEnjt0Iamo8/YNrY07r79BS+OHiYGhSIRj740janlWRGg9RaMXCS/LI+nRd/A3 jVRvxG+gL7cPGDLHtAhryIB+6lIECk34HMvQgr7t1m/L5UGS2GEhlU4jqWswrW89dwsM= X-Gm-Gg: Acq92OH9WfdHGqqR14H50eivbgheSkbwQLAS4/jeaX/L5Upbz94Hj6rlgAStUGJmKKx LBde5PuG4HswAhZJ+mTR4eaChw6b3uFP9GXV2MMQFgi13HkBh8sP/ZQOOrgohaKVb+lANyTgpGM UyKViP+7UhUeQHJhvuqmLWsvdWzOqjjwuniKxnrLdIhrz7HlvOGzRSlzHat63Dw8MPh9vgu+n7d PGRDgqOli/1iPoNJZiNgjoAg7XbsfQwFHj7sSMiSeXiITHZ/ycDwfJ4wH/gjPbY6R9xsLK8eNpZ JFdvICDFXbE1VXAGN+YzOyC7Ta/kqg+8UR4IG6jb5YdiuzRpR3MWVADkjKNveAntEyXDVbk+0n/ I44nlHdGmEki3SEYmXv9r9tC0Z7hfMrLQF/ckdXeFrwCMmBtRSjk+f6v3HUzrfMEiwIo0O9YFBU vDi6vCzPanqq91ITMkiNYoXxv17LtLww== X-Received: by 2002:a17:90b:5790:b0:368:98c0:8836 with SMTP id 98e67ed59e1d1-36951a667c3mr3720184a91.18.1778848960326; Fri, 15 May 2026 05:42:40 -0700 (PDT) X-Received: by 2002:a17:90b:5790:b0:368:98c0:8836 with SMTP id 98e67ed59e1d1-36951a667c3mr3720158a91.18.1778848959811; Fri, 15 May 2026 05:42:39 -0700 (PDT) Received: from QCOM-SocCW5bzXR.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bd5c05f27csm56119395ad.25.2026.05.15.05.42.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 May 2026 05:42:39 -0700 (PDT) From: Jianping Li To: srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org, abelvesa@kernel.org, jorge.ramirez-ortiz@linaro.org Cc: Ekansh Gupta , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org, Jianping Li Subject: [PATCH v5 2/5] misc: fastrpc: Remove buffer from list prior to unmap operation Date: Fri, 15 May 2026 20:42:14 +0800 Message-Id: <20260515124217.20723-3-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260515124217.20723-1-jianping.li@oss.qualcomm.com> References: <20260515124217.20723-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNTE1MDEyOSBTYWx0ZWRfXxa0uKp8IXgri VWaS8OVXFlHTkU4JL7//F1YworNTPlOnnh3VNgnisNGxHT0qwDFl+fE8gU9R5mp6veRqZ9uVf2k 0mbNxeVRC4mB+Mu+1ueqLHqb1q6J41ZdeQIeLGZ5dxNC+JLoFD2z8fc/Zj/MVnq7DWrmGpW9jP2 f+sAa8gPQ90M0cjiLylLd0ojflhhVU+p5/Rv+ZZB3SGaOTuNccupn6E4Jdm9e46M9P3fA1Jy9RP mONNVtVva4zkFr/fsQYV62PagsVY/Synt4pTwq4v255D8KC8yAyVxSw+uNEJoFLPYSWHMAlhHIe UxM4V0Y65cljDqpe/M1zOW5aJGUpiFR6q92jgFGtPh0JyIvNRg4nk9T4D9CWnoBRtmU5ZsNYteX 4r1SxrHeVxaw6hjDcwMw/pTNNJzDUD/dKQsFour/miXrU/wpgBTP3fi4gZv+kgyOUkXqX/ZAyAJ A4ssXlN1rKaW7DmZldQ== X-Proofpoint-GUID: 19b_AFYWoBrJBZMW56UQjk8y1hbjp4Rq X-Proofpoint-ORIG-GUID: 19b_AFYWoBrJBZMW56UQjk8y1hbjp4Rq X-Authority-Analysis: v=2.4 cv=BvqtB4X5 c=1 sm=1 tr=0 ts=6a0714c1 cx=c_pps a=RP+M6JBNLl+fLTcSJhASfg==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=NGcC8JguVDcA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=ZnmZ8TzD_GdZzTgawW0A:9 a=iS9zxrgQBfv6-_F4QbHw:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-05-15_03,2026-05-13_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 phishscore=0 clxscore=1015 priorityscore=1501 spamscore=0 malwarescore=0 bulkscore=0 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605130000 definitions=main-2605150129 From: Ekansh Gupta fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if any other thread removes the entry from list while unmap operation is ongoing. Remove the entry before calling unmap operation. Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 8b21f85cd9f4..3c7c3b410d7d 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1863,9 +1863,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_buf * &args[0]); if (!err) { dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); - spin_lock(&fl->lock); - list_del(&buf->node); - spin_unlock(&fl->lock); fastrpc_buf_free(buf); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); @@ -1879,6 +1876,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) struct fastrpc_buf *buf = NULL, *iter, *b; struct fastrpc_req_munmap req; struct device *dev = fl->sctx->dev; + int err; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1886,6 +1884,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) spin_lock(&fl->lock); list_for_each_entry_safe(iter, b, &fl->mmaps, node) { if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) { + list_del(&iter->node); buf = iter; break; } @@ -1898,7 +1897,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) return -EINVAL; } - return fastrpc_req_munmap_impl(fl, buf); + err = fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); + } + + return err; } static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) @@ -1989,14 +1995,17 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) if (copy_to_user((void __user *)argp, &req, sizeof(req))) { err = -EFAULT; - goto err_assign; + goto err_copy; } dev_dbg(dev, "mmap\t\tpt 0x%09lx OK [len 0x%08llx]\n", buf->raddr, buf->size); return 0; - +err_copy: + spin_lock(&fl->lock); + list_del(&buf->node); + spin_unlock(&fl->lock); err_assign: fastrpc_req_munmap_impl(fl, buf); -- 2.43.0