From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 72FE33DDDDF for ; Tue, 26 May 2026 11:11:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779793908; cv=none; b=czkQyHTp9isz8qYCVI9jUmdHsgLaX1woXb02nmG1xlTRByXNc7YMlAQkNR3OTz2gvZzMxPlFHKNSJIIDTOE+xN01+5b3jzeAfNQHvFAz3W3yFWbalLrRKfzmTAzMeLT1e8E+I4fl8S1bufwQ3EqYGFk7zb1KxtZoAuTQxoVqBOQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779793908; c=relaxed/simple; bh=uwUosZaTRLvg70pMj5LLo47klKvzExFmHdJcqWxZT4Q=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Aegtetrdu+TBzcr1zAEAkt7Cx/ciSBeYEoNQsZeBwjj4wUofsEUa6ZjYbwCSy9LuHkW++IZYnBknfl2yJHCEWXqG3eim0zwndmLGUIthI/FA+7MRsH3RJIX5++WALVqJ8F1IGeQcTa+SCllYNDIlvGuGRDgMEolmx8hw1JVt1IQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=KAUF2vQD; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=cZcu57ip; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="KAUF2vQD"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="cZcu57ip" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64QAMdO11802808 for ; Tue, 26 May 2026 11:11:46 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=h2rbBUksZJT YcjdAJliGesa3QsJPl7wEGaGM4JyELQc=; b=KAUF2vQDBbaZGwDuqkg+NtXqbh2 pJVpFT4JzXSXLkb/67qx6MkDXZUu5zL9kJmAGswpFaU8qqn0aNqWltwON9gbIrp3 sdiJhfNKcwKB3N2kk1Cq4GhlEprFMStaqnDWc8Z6DooCx+/y2dYZmJLU8svprSBa pbIfA2kZfYqkKVOY/T4ThwIsljlGrT0Bbezorpk37O0OISvBD9WixWB6Ikv+w8rS yuDGX1rQv/ZMtl9y3MiE9SDwFYUw52v1528IgHGh9yQYpLI2LkGEfpDa+FPIGpdF AxSexWs49jCBucPZPqBtreXhXIiuLUmucRWowy28iZ7dmlR1N5s9JhXK/Sg== Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4eckyqme6b-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 26 May 2026 11:11:45 +0000 (GMT) Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-368edd5fec4so11559287a91.0 for ; Tue, 26 May 2026 04:11:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1779793905; x=1780398705; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=h2rbBUksZJTYcjdAJliGesa3QsJPl7wEGaGM4JyELQc=; b=cZcu57ipBduZzMmbhgqRkHleV00D/tI5fhGbAA1gi8t6U/RmiJbRdCOT6xJZCsmibi 5xEuzS5mjNkYI9mca9eHMh6DMvbPpFGqe7R9jf/PrIHRq5R8FaT+7yrjn5WFMCIjAKrk X6olCyV5POUGhS5K64fxpsxo9esKgPVtXhUBwclvwIwN3faC3T2UB/XVGPb8O/F8EjPB CleyKGJly4pIhVGUM7vt1hXLbQuKf6bJB95r1CQrbjtqNWN5G0XFjNiYJzmuFCRbTgjE tDmkLgcT55ce/MXjR3S2CFDbKKUvSkYMAQrlI7AtphEVJ/N/FSsxH5NoSXXojcx3GBFo aJjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779793905; x=1780398705; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=h2rbBUksZJTYcjdAJliGesa3QsJPl7wEGaGM4JyELQc=; b=IDVq1xHV0DhN8KC0e8mzzigpwRtn9bDDEHtYm2U6YktFElNLh5YYbDVPxx7aLrwHs5 xtMJtIeuH0zcKWui8XFgsSx7kU1JhB5B2yn/H336UKUGICnaTu/LfWJWBlFlqb+M3Ino vY9LAdvWY6Xz6Mmkoe6OpOrj28VbfvoXn3FJ+/0ZuMeeMDsmPnaPhxLJ1Gf0TP6WlwfK 7TIcWd49FcdR0RElh+0tHpQxg4nG8uqobsZfCTjozAiW6IHJ01hziNe6SlO2pwWHf96e ltYhiBUhNIX4VqwET7SpDtDGa/Ck+eR0A0w43VwElUCdP82wWixUgaUwQ2z8Lv/6hGnB jQ9w== X-Forwarded-Encrypted: i=1; AFNElJ/umC4a/FkK2dSrZH/95PA+9XGg4PtHU54kFLaEAiTv0iVEHa7OL5PP1yoYTh67ZAzpngmgoTxT6lNtJHM=@vger.kernel.org X-Gm-Message-State: AOJu0YxF4RuvV9EbX8sCg2pNAwD6PDQHOI5ShvBG0hRSteY0/QUDmppQ dCvywbU7XHZPZ4PAkbaiv47aGwfI9pIA4a9DTJkJ6T5Pr+1oIRdrOltOcndCOazmscCA6EUGcY0 fpMexhfyMdyfm50gB+ByL9+EBjRm0w6mlPgUjc1q8Ywbd4MlRrOlNE7wjIhDJvtUm0mc= X-Gm-Gg: Acq92OFyXwgfVjhY06YaBbEYf1FaAJbBZvp9yKNsl18SH2QGCGhV1DJFzbuZeQ42FbE 4QfSaOkAEEhYMPaGs7ffDUcvgOaHxlxXBd1XTeZSyjbBLvcOaO6221MGQkmDXHjrNsE6N8atbUJ nWKHPioWnARCaWhCJaPd+NIMmNaCSP+dBadF7zdpzT8431YGyjqV9Y8JI8Tbz7ozw9X1t53jz6t 7nz3xEseW0mndFZZ34aySPQlih8ixYauRYEeuUFg5D8+YrOIMYJ90GuUtK8K9iwCPmYd6equRLW ietRyJCsePG5bTUSBCmy4fBi31o5snxKnlH0BJU88jgQWbl6ggtbIU0Qi3R/lyRCjdbXA9GgGOn i6yXOU3H1hFLO6e5PI9pcFKc/v5oWt8BNFjjLXti0ITvuq3eaFVryltHyng0D8mvSSGgnfR9rcF sb8ZJ8PzHObY95Y5SnQA== X-Received: by 2002:a17:90b:58c4:b0:36a:2a9b:3fb5 with SMTP id 98e67ed59e1d1-36a677f4ba2mr16425722a91.18.1779793904689; Tue, 26 May 2026 04:11:44 -0700 (PDT) X-Received: by 2002:a17:90b:58c4:b0:36a:2a9b:3fb5 with SMTP id 98e67ed59e1d1-36a677f4ba2mr16425670a91.18.1779793904174; Tue, 26 May 2026 04:11:44 -0700 (PDT) Received: from QCOM-SocCW5bzXR.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36a72c4ce6bsm12104253a91.11.2026.05.26.04.11.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 May 2026 04:11:43 -0700 (PDT) From: Jianping Li To: srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org, abelvesa@kernel.org, jorge.ramirez@oss.qualcomm.com Cc: Ekansh Gupta , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org, Jianping Li Subject: [PATCH v6 2/5] misc: fastrpc: Remove buffer from list prior to unmap operation Date: Tue, 26 May 2026 19:11:21 +0800 Message-Id: <20260526111124.515-3-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260526111124.515-1-jianping.li@oss.qualcomm.com> References: <20260526111124.515-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Authority-Analysis: v=2.4 cv=RMyD2Yi+ c=1 sm=1 tr=0 ts=6a157ff2 cx=c_pps a=RP+M6JBNLl+fLTcSJhASfg==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=NGcC8JguVDcA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=8ZZxLbFAX5vHFMKIXQAA:9 a=iS9zxrgQBfv6-_F4QbHw:22 X-Proofpoint-ORIG-GUID: IpV5yvxVwPm3ZzLqCQMZUxx2TM6jriWK X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNTI2MDA5NyBTYWx0ZWRfX+++DNarmUiCl 1Z4mIYuQNebE2MRdZpUbYWrseAbRJQJ192cfTR9SweVy8OdHLBK98U+Cf/1dnjHSnoCjf7k/kQu d958QV7ERSp5jL2qqCL0jeqMXXsa4xF0FcXEO/78DdVhg3B/edHXzeq/X9Ogl2I8d1IsiY5TYCb HBiTaVh6i7ri6GsEzVw5diAu4/uA7pTECGOtN2R2wqnKNge/Eq0XAidF/Gvb6VQGhqgGpe4xRC/ nw/vtQzyZbJjYTSqzUOWDJ5QSD2149LN5kX8tSXmj/O6TB1RHQHywt3uczDfpRmxWCQvoJDAyEU b3DMYMuhIXYpSkG/scfaTSu3zZvN7JIt8gZUzRJiYklUH7tmC8ieZALz+vw58YBV8XEuM8oJoEn 6yfkKma08HDTc0RoQ8ftNj1zcXtheO1ClDPM7M3YsHVSNUyBZfUEXwRFfDw3TPHaB+kU7/1Z/U5 p2bRlUjhiHEa4KpxqXg== X-Proofpoint-GUID: IpV5yvxVwPm3ZzLqCQMZUxx2TM6jriWK X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-05-26_02,2026-05-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 priorityscore=1501 malwarescore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 adultscore=0 impostorscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605130000 definitions=main-2605260097 From: Ekansh Gupta fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if multiple threads invoke unmap concurrently, where one thread may remove the entry from the list while another thread's unmap operation is still ongoing. Fix this by removing the buffer entry from the list before calling the unmap operation. If the unmap fails, the entry is re-added to the list so that userspace can retry the unmap, or alternatively, the buffer will be cleaned up during device release when the DSP process is torn down and all DSP-side mappings are freed along with remaining buffers in the list. Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 80a636962357..a8a58f889d07 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1892,9 +1892,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_buf * &args[0]); if (!err) { dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); - spin_lock(&fl->lock); - list_del(&buf->node); - spin_unlock(&fl->lock); fastrpc_buf_free(buf); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); @@ -1908,6 +1905,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) struct fastrpc_buf *buf = NULL, *iter, *b; struct fastrpc_req_munmap req; struct device *dev = fl->sctx->dev; + int err; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1915,6 +1913,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) spin_lock(&fl->lock); list_for_each_entry_safe(iter, b, &fl->mmaps, node) { if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) { + list_del(&iter->node); buf = iter; break; } @@ -1927,7 +1926,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) return -EINVAL; } - return fastrpc_req_munmap_impl(fl, buf); + err = fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); + } + + return err; } static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) -- 2.43.0