From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6171D35E94E for ; Tue, 9 Jun 2026 02:59:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780974000; cv=none; b=nvXiOmj1Nk4eLD1IpDX5t9vhnBsOS/3ADiFQeKaEj3NPZCajr8VTrhnCFYCjrPCGuu1oybdJuyrKTsbqRDBfRWN4mbRXGA5vnTVdklEhijYUa5ox7ZXfhzKOkzRoxIzWeV5E1NSLbeFYoQVk0ke8FM8ZoSjEFsA5aCcDzCAiTgg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780974000; c=relaxed/simple; bh=J9nj17thOlGzPahnaTqDVNfO8rb0kLcDs2KR7R3KsRo=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=RWZJYdCQUKJWC54oqkCa8zVI/byyovw/Tv1fKnqDaROA1Xwy2wQ67qjhAbqxA0LhTbgdjHZZcWnZdgMAHm3pnVfzpK7WRjTTG4vBymVPOM1N0eKRrb9E6t4wxbN3UH6n+i4goKGRRsEhDjUmMlfQ/A5MXyZppHDlTaXK4hpdY1g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=QT6cHTm9; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=jkrHqh9w; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="QT6cHTm9"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="jkrHqh9w" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6590sGX71074587 for ; Tue, 9 Jun 2026 02:59:58 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=ElYvFMoGdW9 Bjq7mp/Mwc7VFbd+iwp1MQ9hRnfKtsl0=; b=QT6cHTm9kd3vTgLWiwXDjrQp42F vSktu05K//kW+kT1GQCCh2KF68IvTIaBW/boH+OYex8ZDklrq7be68h2kRVZAryw 8uKlYYZVneuNsgAWTTwW/5VdEyVUlChbosaPTY+SJOQqYX3A+NQAq19z4tJ8xrWk 5W+AeN/0tOI8rFqzWDwS4XyT6dpjfkAbxqY1Jt1ywSJo6fmQjKaPfE+frkxRJl+q PZ2aTgYrQMSXVLvy1nZw84HI334Mi4LPHv1An6rbNBg8sCsdl64D+3bbna1dX5fe aYKpDryfpYyJCKGSviwSrXP0tT6iSYfpq6r4KR3DjnuRiyD0jCt+Vg1I+Qw== Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4entr0mc1x-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 09 Jun 2026 02:59:58 +0000 (GMT) Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-36d98b76d12so3482646a91.2 for ; Mon, 08 Jun 2026 19:59:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1780973997; x=1781578797; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ElYvFMoGdW9Bjq7mp/Mwc7VFbd+iwp1MQ9hRnfKtsl0=; b=jkrHqh9wl0g6s1ZYoMBmbUUCG1ldwXg3Oj8bDraUCh0zGqF+V68g3jnqwqA1ZCfsmh iyKpuIFoQM8k0sF2IUEdgxoe6mP0iv7JkHwmi7Au5WetWEIQTDqIAqXLM5I0GHpfb/nT lz5qv32jevhcACBm0d+01/vgaR+zFmBhiHiSmBZAmVkQ3zs6nBoveU/f/n1aTAFjSfKI i6eX5pohvxX2PNano28xlus01iY8Cgnx9vwilVM6vxWc04NX4ZIe7ZaWlvbWz1mPATKh OaKtI0Z8gQog7ftp+qxnzIOL1hMyqNK2W3QLcrLRZvqSh/T49djd8pO8X/iClcOQrhsr 8hWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780973997; x=1781578797; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=ElYvFMoGdW9Bjq7mp/Mwc7VFbd+iwp1MQ9hRnfKtsl0=; b=B0TqU7hYe98MtDCge6Xad5onGx/KVO74zqZHRwyxj51j3eaInPIfk0SaIGxxyB55BD dKfWL4QybJ+kiyBgZh0xnwwtOZAF9imeXFMKSC3D1t3I42Ur1TWGJenUtNgMPCQVwuO2 8kjpYbMmd09IP9l8ip0tf+q8WaYNQfEORKGPca90xFQ7Ubf9RMige0Y+NtfMrOYKtHaS sHhGfXTktPWe25SnJ3PAnrODY17lUTUVMR6JjoYDmoLFOT5W5QKS9/3aSMhkvy1HmzAW pXNAGXQ+s+FAgwavQTZsGP8b31Xutn3th6yERGGaUPUJSnCn7buJFlrOWfeSTH1/eFKv FXgg== X-Forwarded-Encrypted: i=1; AFNElJ8Z5t04SFtTTfL7wKIamn5QcQ8R8x0eqQfB6kVLdc7zrpAa4a9i/pv5YD+8dXYSehML5K7DC4/c9Dib7OE=@vger.kernel.org X-Gm-Message-State: AOJu0Yzab/LlXJww6A250VgxgxNdjgzDpk3Nj83zGSrJQYk3M7aNyWHj y5CRImQPHXrA2nDVTrk1wNFKUvN2ubhSvpH2fyklf6ut8Iv66mOUbXk0sHDIBRLjtPxgMWzd4uw 0uFGpuKch+7IZfVdGEYfpQ3njxMPSogQXzLEziVIIMLp8Boz8QxbJAP1jUlWTL4fy9O8= X-Gm-Gg: Acq92OFKaMMTLUiKhvfTcEyL7ccuML2i0X0ZbcKu3WWtzXLfirNMlQ5fib/7YI7aDoh 2CODpIKClTXkOo0Sm3ksAn+MqcDmGqiMBTXgDdnYP8WNYT0fUSzOGAxANie3mIaI4+rXLbu8E0O bL0n/YbPorEleUcqm63Lfpqqs9oT/V90vX0L5DK1ICId2H597gNJueTd9XxBlYmifN8az47X7SU rt0zld7/tnn4lf5rLZoykli7Brk94wYU3RA4kH+mnJARsdzwTzuCFEiGOpI5+buol5CBydxtcBr sropTnjr4BKCN91tLeBUjL5YEQQyPmUPphoeiGGuZwvPsA0r28EPKCbawQywU3Jo9BBnttNTqE3 S4ShoGXBl3WRt66nATnY1HSW52BEtwXholimno861iT+BhkllEkzl87IK5PkT4a+5/lkEiCmGdc FMxBjAJQRyuO6S8LCoJI4z07+q9/iw X-Received: by 2002:a17:90b:390e:b0:36b:9835:cf96 with SMTP id 98e67ed59e1d1-370ee643691mr18535153a91.2.1780973997401; Mon, 08 Jun 2026 19:59:57 -0700 (PDT) X-Received: by 2002:a17:90b:390e:b0:36b:9835:cf96 with SMTP id 98e67ed59e1d1-370ee643691mr18535114a91.2.1780973996941; Mon, 08 Jun 2026 19:59:56 -0700 (PDT) Received: from QCOM-SocCW5bzXR.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3712fcb2607sm8713835a91.0.2026.06.08.19.59.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 08 Jun 2026 19:59:56 -0700 (PDT) From: Jianping Li To: Srinivas Kandagatla , Amol Maheshwari Cc: Ekansh Gupta , Arnd Bergmann , Greg Kroah-Hartman , Abel Vesa , Jorge Ramirez-Ortiz , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org, Dmitry Baryshkov , Jianping Li Subject: [PATCH v8 2/4] misc: fastrpc: Remove buffer from list prior to unmap operation Date: Tue, 9 Jun 2026 10:59:36 +0800 Message-Id: <20260609025938.457-3-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260609025938.457-1-jianping.li@oss.qualcomm.com> References: <20260609025938.457-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjA5MDAyNSBTYWx0ZWRfX5iFW4LiINeh4 FeATXN15+IEmxITsepQ2d3dWLOJgtL6ZQODaxcktUYAwYcqRAtN2NCoTyB5VefSPyR/NUpobAGa 3HPMorG3myVrnKRQDMC53l795m51bkRY3IITwLAfnEhOyVwm5FuOwqDQkLDWqXCrfAVaLMkWOMg lgf5DfiuqWRVP7BUL6oV525iLq3KMOsQzmcyUapFDcN0wp8Fp42M1i1hr1X8ZbJj+aFcKUbg9WD xF0Dlqwfkqi3VbhJ3zgA9kKVfDZUS7A0zN/nt83Rl/ttHR5RnWN7nQehLii2ssDHRymg9cR/7+A 4Lfr+zkgAogSnfGESZAsj/NyDgJz8chTFttPSVvZ6rtSYcuM9mELB5mw1/3l0fX9taj7RyoKi21 psXNg44MROjhmkyVwAcINDOp6nyyaHIx72EhiV9xViCjpy1eS+4Z/NnCMTravmX5sb59/PEvaLW aWtnh/lVSZxfx7szxYw== X-Proofpoint-ORIG-GUID: v5HJpEhImp7QJOhGI5i9MzZGEi0uLfoP X-Proofpoint-GUID: v5HJpEhImp7QJOhGI5i9MzZGEi0uLfoP X-Authority-Analysis: v=2.4 cv=VowTxe2n c=1 sm=1 tr=0 ts=6a2781ae cx=c_pps a=0uOsjrqzRL749jD1oC5vDA==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=8ZZxLbFAX5vHFMKIXQAA:9 a=mQ_c8vxmzFEMiUWkPHU9:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-08_06,2026-06-09_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 lowpriorityscore=0 malwarescore=0 suspectscore=0 bulkscore=0 clxscore=1015 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606090025 From: Ekansh Gupta fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if multiple threads invoke unmap concurrently, where one thread may remove the entry from the list while another thread's unmap operation is still ongoing. Fix this by removing the buffer entry from the list before calling the unmap operation. If the unmap fails, the entry is re-added to the list so that userspace can retry the unmap, or alternatively, the buffer will be cleaned up during device release when the DSP process is torn down and all DSP-side mappings are freed along with remaining buffers in the list. Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Cc: stable@kernel.org Reviewed-by: Dmitry Baryshkov Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 96961217b856..517884000331 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1889,9 +1889,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_buf * &args[0]); if (!err) { dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); - spin_lock(&fl->lock); - list_del(&buf->node); - spin_unlock(&fl->lock); fastrpc_buf_free(buf); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); @@ -1905,6 +1902,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) struct fastrpc_buf *buf = NULL, *iter, *b; struct fastrpc_req_munmap req; struct device *dev = fl->sctx->dev; + int err; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1912,6 +1910,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) spin_lock(&fl->lock); list_for_each_entry_safe(iter, b, &fl->mmaps, node) { if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) { + list_del(&iter->node); buf = iter; break; } @@ -1924,7 +1923,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) return -EINVAL; } - return fastrpc_req_munmap_impl(fl, buf); + err = fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); + } + + return err; } static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) -- 2.43.0