From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CBC4346E56 for ; Thu, 25 Jun 2026 08:08:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782374923; cv=none; b=E9SjO+YIDWLoDB27bGpNJfzdxuuO3CWfjqcSOx3pAK14gbZ5QFLQlJrYRbqdkiiafHA9aU5zlDb6SPlo0E2rfeC8zDD74u7pAkeSyxqSM6CMqeqGS/UHrPYKiMSLaUtY4wtWBoEkZH+8scxCTAbI3JsJRlINTPhxfr5QgaxKOac= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782374923; c=relaxed/simple; bh=OJdoDx2djskYq7ZseDJEihZ8UZA9lThjt+Rxl/XT9IU=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=VaO/mzEPcj9U8Y0Z/S/Ft/dpz7UWZ+7nzkGGgiVsX+YG2SB9HOEyQTzauxNwnqL2lrYuGh4dz7KUib6NZCsWeOeUp/jHqaysmvPlxa3tYHR2N5x3Pf/UYgXZD0HBCgO13vivBdQKLPsE3jlQoWP1AUaGkNlyEHRJxFMX5lbSGJk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=c1AYtYZs; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=If4N5fD+; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="c1AYtYZs"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="If4N5fD+" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65P3e3bK1225241 for ; Thu, 25 Jun 2026 08:08:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:message-id:mime-version :subject:to; s=qcppdkim1; bh=sb+3siK+bp3PKyAROTwDlHIQzDF1Ozu9V1v 6eRxHPHs=; b=c1AYtYZsA5L6JLazbZ0GHTuR3U/9PQ+N5i+ft17sh3hgufBUOgi 2Qvo0TE3TETJwTsPU9lbIaKTvnqB4ZZjOBX6M91tdSnQPrzoEQY6hF9tecN06PG3 U7OI3my9GCTr4H7mghOYUU877iaeoUcVoDuuTl+tOcuHS7vRkQdOM1AbTqziKqkD SA7I0tbfiAiCx21lE9RehRwYKKzHcb9ojJLQyHQc7RehT1LHcPI8jDyAS6oZAD00 6GrvwIRfiv0JC2Wfr2BNNHqWywX8SG9bIJvpvnb2UmMxYlZ3cM25XmpaJsiH5FaS 8qltYuktOFUHyaY2RnJ1FYw3rLrsgM4TwxQ== Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4f0uyqh2rc-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 25 Jun 2026 08:08:40 +0000 (GMT) Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-845b97ebc72so225223b3a.3 for ; Thu, 25 Jun 2026 01:08:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1782374920; x=1782979720; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=sb+3siK+bp3PKyAROTwDlHIQzDF1Ozu9V1v6eRxHPHs=; b=If4N5fD+YaAf5kD2JhFtX7fqo9pxf9AxfYGgxM5pmAxe9NgkVE1dcZhf2RgrTd+Uqr yY7/balBN0ts4V2OoRiTxRYcep2SZMqg4bpwuXio8bjc2ViRyTZxPrvapn3geah+hO3a YeJjsRmo5DcGz19dJyy0jAIfBwyvhKKd4Mvtxa1OHtJ6UXBU14DMe49Thyb9qBN6YmMt Ggn4yd4tZS2/SzxOikyRZDqOOL0YKTsrDnvdTieT9z7N2iBZ/LsUKK4deZf+75D43TlY JR/XnXcqGh85x4Or5W3gOvpv2Or0ETvrrixeMD5ArTMOzyfo/ZQQBHbbyNVvlyEO/ERD Lzrg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782374920; x=1782979720; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=sb+3siK+bp3PKyAROTwDlHIQzDF1Ozu9V1v6eRxHPHs=; b=Yl+weOU6KWcB99XhIVuhHD7RwMinGKHFQRumzn1IuXH94e17vgszqKmzVQxCqg4fG/ z3SkIr6ijhjV3sLtE1E7Zq6ymBqbcm2G+YKr0D2yTDpWdOOTt/iGDqJomJuzuNVzrQX9 lLDPurc6MtWKatLuMF9tFb/PrVS6wD2RFTOE80jQn9dtD2rn/IPniCnXuVJCNNzo1VJ8 YEwMv74iIaPZsO5Wrup3AXYcTeG3Iuv0xBniIjodEJ4JmIeHmVFTWb44K+DXHylNPIce sXU38+9MIqZvyY4TX25eGCmDefkROKR0h+3EnMV+XJp6vPI2vOnGBEs+3/9TdvY+lvIn ZJig== X-Forwarded-Encrypted: i=1; AHgh+Rq63m1S1oKDAaLAnurPt1KSnBfSt5HjWAkmrvexNkuY9l+hO/kLii/4LP1GM6uVJWaZgjnyXvKFsvNSIQg=@vger.kernel.org X-Gm-Message-State: AOJu0YwtWzrXcwMuI+AeagBHgnUFvFH/hTxVHGzyarZPY7bZPTdTTuTL BI0L562Yot5GCUofX//5o7uYdfjsVuUoKDLOPsIxh/eEzHEJeq7NBVGG8w5qpNq1ng9bdB0mDEt E9cjJ417saG1cH4cAF83z8qrQcd14xV2ainwDwMaxjUWfckDghmWsSeNkuzP3vYSoDPU= X-Gm-Gg: AfdE7clAVd5Mptf45F55naTu3wyzBnStJKaOB/4AkuzjHj9jbI/ltRXPFkALJXa2dR+ wL8S7fe8KrpNvHAxKb4QB7HcC9idcALTo8624dekbm/nguyt+ANCghWjHwQa0SlT5iRkTmO5w1I t2cmVvO8LXJMyBouh2qiyuyfBrUV2OePP/ANTEAna3shgb0Iwbq5X2zxJ3o2ky1D13SaCskFvyV i8NpoAftrrpagSB1T5xjU66kAo5u8SHCu1a1R2sN+38Fe9C4JsM1qmwFz8thZqUhYC1w0hv7UX4 sk+f3iOjaZKt9sDCbi0CpojcZsoq773e7k9Gp0TfkoKQpy8S8qkFfmhMRMhdCPgBT+ZZI7prbu1 yFPixplqkshsbtG7xW18Ujm3/o9gflq6RkBmKFf6SAtO6+54JU21MzPSe6hfm8HemgcOvEZMIbm m3FVW0vo3L X-Received: by 2002:a05:6a00:14cd:b0:842:4387:34c2 with SMTP id d2e1a72fcca58-845b39f2224mr1854517b3a.10.1782374919838; Thu, 25 Jun 2026 01:08:39 -0700 (PDT) X-Received: by 2002:a05:6a00:14cd:b0:842:4387:34c2 with SMTP id d2e1a72fcca58-845b39f2224mr1854476b3a.10.1782374919366; Thu, 25 Jun 2026 01:08:39 -0700 (PDT) Received: from QCOM-SocCW5bzXR.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-845b927cc0bsm495077b3a.21.2026.06.25.01.08.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jun 2026 01:08:39 -0700 (PDT) From: Jianping Li To: Srinivas Kandagatla , Amol Maheshwari Cc: Jianping Li , Arnd Bergmann , Greg Kroah-Hartman , Dmitry Baryshkov , Ling Xu , Ekansh Gupta , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org Subject: [PATCH v1] misc: fastrpc: avoid duplicate DMA mappings in fastrpc_create_maps() Date: Thu, 25 Jun 2026 16:08:32 +0800 Message-Id: <20260625080832.17477-1-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-GUID: UBXxPz9Kyd8_9hLULCOV-CXlsAz76vRd X-Proofpoint-ORIG-GUID: UBXxPz9Kyd8_9hLULCOV-CXlsAz76vRd X-Proofpoint-Spam-Info: AW1haW4tMjYwNjI1MDA2OSBTYWx0ZWRfX87mMhnKs5YQK CVqzDmqR0q91typjqJ52/xjWyEzwSa9gnu2pmY7razF0C8a68XkWVC2WFcUJBDcjsbGSj6eiGED lGQ2f5tiZPl4sVYj3rYSw4wd5u46G4A= X-Authority-Analysis: v=2.4 cv=EsLiaycA c=1 sm=1 tr=0 ts=6a3ce208 cx=c_pps a=mDZGXZTwRPZaeRUbqKGCBw==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=oQxmpDa7-PQQZ_56PAcA:9 a=zc0IvFSfCIW2DFIPzwfm:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjI1MDA2OSBTYWx0ZWRfX5c7sdmmhk1Ut pBzDfXKGZ844tpoVW4XbhWvAZdA+UOd6V0uYP4liOstMB9UdpiFqMibZX9DyxxdxS2xLwTp4v3C wG12oS1GLgWJ9hHrBvVFTdm4xeaUc1GBiSAwgB4/FfvD4LdXQkwmiDT/S9/oHgA0eCQW9buoL98 NTp9BqjppmudAcqGQbQPpuzW6ArleWyjgcJyBW4IR+MeFIpxyPDLNf0pGrzvbz91+PGAO6NcFFL kkQSVyPti2vfTBUWyJ0o8DRoUWdoZ3lSP3vIKE7RtnG1IuJKjiTK7YhNjQc9ePMgJdE4rUuA0we 7sqyqGuNMfNqcd2vOeEMIoHx1KSgZ1/5NmMUNssp0fvDP+CYr30443WfUKoMBPKTz1D+6t3ykNV K0PIkGVgedJL9/Donb48vvMf7PSKs4g5dGSmWB1KawmZYCG27FhZN6LSUBVKQH9SWaAoRqw90Bt sLDHVEXC1IWga5bDDRw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-25_01,2026-06-24_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 adultscore=0 spamscore=0 malwarescore=0 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606250069 fastrpc_create_maps() performs map lookup only for buffer arguments (i < ctx->nbufs) via fastrpc_map_create(). For arguments beyond this range, no lookup is performed, which can result in duplicate DMA mappings for the same file descriptor. Additionally, if the same file descriptor is passed multiple times within a single invocation, performing lookups with reference counting would increment the reference multiple times, while fastrpc_put_args() would release it only once, leading to an imbalanced reference count. Fix this by allowing fastrpc_map_create() to control whether the lookup should take a reference. For arguments beyond ctx->nbufs, the lookup is performed without taking a reference, ensuring that existing mappings are reused without introducing duplicate DMA mappings or reference count imbalance. Fixes: 10df039834f84 ("misc: fastrpc: Skip reference for DMA handles") Cc: stable@kernel.org Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index a9b2ae44c06f..2622a1360a65 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -924,9 +924,9 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, } static int fastrpc_map_create(struct fastrpc_user *fl, int fd, - u64 len, u32 attr, struct fastrpc_map **ppmap) + u64 len, u32 attr, struct fastrpc_map **ppmap, bool take_ref) { - if (!fastrpc_map_lookup(fl, fd, ppmap, true)) + if (!fastrpc_map_lookup(fl, fd, ppmap, take_ref)) return 0; return fastrpc_map_attach(fl, fd, len, attr, ppmap); @@ -999,23 +999,23 @@ static int fastrpc_create_maps(struct fastrpc_invoke_ctx *ctx) int i, err; for (i = 0; i < ctx->nscalars; ++i) { + bool take_ref = true; if (ctx->args[i].fd == 0 || ctx->args[i].fd == -1 || ctx->args[i].length == 0) continue; - if (i < ctx->nbufs) - err = fastrpc_map_create(ctx->fl, ctx->args[i].fd, - ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); - else - err = fastrpc_map_attach(ctx->fl, ctx->args[i].fd, - ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); + if (i >= ctx->nbufs) + take_ref = false; + + err = fastrpc_map_create(ctx->fl, ctx->args[i].fd, ctx->args[i].length, + ctx->args[i].attr, &ctx->maps[i], take_ref); if (err) { dev_err(dev, "Error Creating map %d\n", err); return -EINVAL; } - } + return 0; } @@ -1508,7 +1508,7 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl, fl->pd = USER_PD; if (init.filelen && init.filefd) { - err = fastrpc_map_create(fl, init.filefd, init.filelen, 0, &map); + err = fastrpc_map_create(fl, init.filefd, init.filelen, 0, &map, true); if (err) goto err; } @@ -2100,7 +2100,7 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp) return -EFAULT; /* create SMMU mapping */ - err = fastrpc_map_create(fl, req.fd, req.length, 0, &map); + err = fastrpc_map_create(fl, req.fd, req.length, 0, &map, true); if (err) { dev_err(dev, "failed to map buffer, fd = %d\n", req.fd); return err; -- 2.43.0