From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0ED837DEA4 for ; Fri, 3 Jul 2026 06:28:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783060115; cv=none; b=FvmcX3Zs7YegrYBBFQbNQfYghzOwINQcwEz82NhtgddrCL1y2rgP3lHsEoRfdAMZrNGx1gj0hBYLNnl/vJuG6pJBe8e7iJbVoASjOMXDL/kh7GpRubo/icrRa+bknLSvUVvGr6j8pNyu2V0UP7n5rWFvUDM9DJSkFS9D4gzpryw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783060115; c=relaxed/simple; bh=F+0F4H3vY/LaE7NZ65CzhaqwQqmsI4EWEocRmfjYnkA=; h=Message-ID:Date:MIME-Version:Subject:To:References:From:Cc: In-Reply-To:Content-Type; b=ZiIZrzcONqtVS8HfTrtc6wM1ioH3X/WMqiaG3GbFZJTIL2TikwymmRzoxLJBPUTo9YfTzXM0GN0V9pnybPC9dPIiIN1Ai8jqxhbzgI636h7mUDSvZYJsvNqqrbRkuFi+cq8HMxgOLpdV42/UaKPnWWMnVcx7dDR9SAxJyQKyzZI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=U9Nv5EcC; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=jilDnSic; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="U9Nv5EcC"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="jilDnSic" Received: from pps.filterd (m0279864.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6635rmtV2961702 for ; Fri, 3 Jul 2026 06:28:33 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= r9DM8Go2RjnzqwoByfIyzL3ou20U9NAg7EwEKzgleYs=; b=U9Nv5EcChCcpZbE1 lg+uK36ii2OVRC65b8XbcHe3hj7aN/Qh8/SR+ojhdmY/E0AjQuP+B9jgrYKg0MSN J2wOfwdjOIBZ5yDhhOdlpNqdiE+bM+cRD8H+3zqYIbcmjCdzVICKMb4nQpqVb/Ig dQdJnk4tDeRAj8ZmUySBJefO8tjJ6RRDiQdRJRDaDXBDTUYl1ixVGPdfT5ROIG4m j2Q2yQButRpPXMehYwVdmPrlPn7wd++hBBrKxDgKVpEBW/pD6TJ2/LmVFsD+d+C+ nyqT1M126wgHKsJJDjcoBWh+e/c2Ycu5Y294erft1YpnnMck9pgAEN4F3kTljWMq ZUbfcg== Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4f5nprck0g-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 03 Jul 2026 06:28:33 +0000 (GMT) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2c80be91ea3so4770645ad.1 for ; Thu, 02 Jul 2026 23:28:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1783060112; x=1783664912; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:cc:from :content-language:references:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=r9DM8Go2RjnzqwoByfIyzL3ou20U9NAg7EwEKzgleYs=; b=jilDnSiclwUpjkPPhenunThevyzk4PvLb/bH/wiqxL1jNzXpMvAu1Ww3YBjHoMGXH5 79a784w0kTubSQkOLEz3ztUvOUVPxUM6ybdIWO34bsjNYdBKhsfraXIW1C4giBt/qWk9 gTNKhGZA5pnZHCijLuHZFYZkNYX9lo4yP/huraMWAwLRt4J9NhA2FpQCjLyhDaT/QdYC c70To/bP3Ol4yfhQRmaGGDx1pHxJ3s4tzj3BoaK2wyq5JbaWIEqPyxm0ez6IO2BMKOgI EbPyazC7BXKYLf9wmS87s9bIrTp1WSWQVhTR5uUFaIPSAw0uiqjCQWH51lhLWWA/owq5 8s3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783060112; x=1783664912; h=content-transfer-encoding:content-type:in-reply-to:cc:from :content-language:references:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=r9DM8Go2RjnzqwoByfIyzL3ou20U9NAg7EwEKzgleYs=; b=ORa5+JXOCMRmgpyqHSIU8G2VpcZ7mRiL66LzglpCCNNP83GPSKUBs/MU+g2lFCrp7l ZZ6FYVv78jSYld8xHQRbbWcjfkJsfIJ7UAhTCPcc9I4kcNDSkL23ABxIcCje1cgwbBCx ia7PYuSwne4Jq8ltDjMeVGofAQNvXZ/xK40qfSvADZvZmzf8uVjqBFGb9vsQ/D6uN+DZ IxMu16FwuvG0HHc3qj0oPyCwb0MuuTfpKd5W7+xuRqphGiZ/3IDaktlLV4tTesRcr+Dk zflb1nZ1G/i0zLWLOrs60yeOS/gqph67qTJ8MUsYtlI1QK4B+cITFtaqjRN44nCtkBZn h7Rw== X-Forwarded-Encrypted: i=1; AHgh+RrFqMqdrznCXuvIi8tXGMtKR3pfGrBRRopaXK6nUB/1dWmLztbpYtFlHp37t7Zp43NtGffqAAckrheiO60=@vger.kernel.org X-Gm-Message-State: AOJu0Yx5gn9xbEIHF3UEftnE1Peso5PMbpbHz9N+/jGjtE6UhB8GYztJ DULZagaLjhuONkRRvMvxd8zPkSeANFsbs30njt8oZB+T6p9Au5hZuzxpJQhZElL+RXDHbJZ2Cka XI0EFozyJ2vyI7whftFnVpzCmHOWoE4+jPVBpgnTBhWQN0cvK93sKgmVjOy/1N/kM5Js= X-Gm-Gg: AfdE7cmk+xOCFaxgpLbTOU+WUDkW4hDv7O7R2ETQyV5be6B7ja1cfPV90UePSu2apEP ri92M8scP/VQDWVNpGl7FgrkQAn5iFEWo6KBAa0Y3wjiG9oTR3Fq1shd0/yqyngg1Lb9qMDHV42 7tmIri5Xq75p0HkRE8tP8A2wpZR0c+Eb1QG8/uaWAImCkCiJXRyYtdMSCQBs36J+2aS6WfJlDDh NBrsU+ApM+ftHgwGNk8H8bY3gwHoSTytqxiz7D/1jY/6XoMl84ZkJZhkXLWXdTPatKsGi48B1DK JAy44elGm+Spx3H4WGcKqRt0BF+0v/5KXLGamVg/6YwjU999jAb7IKk+hWiuSv1Fu/hbXmTNQaO 2ibAsif5KoGiv9Vq3+XT+4FupnAOjh8pJ9RTw1vFSvkZVt3M0VhgAR3aflWRssawTayWKxkOa5G 44mJf1ew== X-Received: by 2002:a17:902:d2ce:b0:2ca:ce91:f027 with SMTP id d9443c01a7336-2cace91f1eamr28805935ad.36.1783060112158; Thu, 02 Jul 2026 23:28:32 -0700 (PDT) X-Received: by 2002:a17:902:d2ce:b0:2ca:ce91:f027 with SMTP id d9443c01a7336-2cace91f1eamr28805545ad.36.1783060111658; Thu, 02 Jul 2026 23:28:31 -0700 (PDT) Received: from [10.133.33.167] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cad6f260c7sm4483705ad.12.2026.07.02.23.28.28 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 02 Jul 2026 23:28:31 -0700 (PDT) Message-ID: <630c7fe6-bcc6-475e-9738-2d90d63eb050@oss.qualcomm.com> Date: Fri, 3 Jul 2026 14:28:26 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v1] misc: fastrpc: avoid duplicate DMA mappings in fastrpc_create_maps() To: Ekansh Gupta , Srinivas Kandagatla , amahesh@qti.qualcomm.com References: <20260625080832.17477-1-jianping.li@oss.qualcomm.com> Content-Language: en-US From: Jianping Li Cc: arnd@arndb.de, Greg KH , Dmitry Baryshkov , quic_lxu5@quicinc.com, linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Proofpoint-ORIG-GUID: mXtKtJ_tXTAekEDgoKpk_Cby3DWkv659 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAzMDA1OSBTYWx0ZWRfXzy7LjuxS+KDx f15zMhtLnSQ9dPQxs1ku/vNicRYTrewKK4juS3zu+L69KoTmnciY0cM+ECPQtO/CLhiGBYPA/bJ ZrKmduDlDUyA/4RkxEsbvyrwOz7axIc= X-Authority-Analysis: v=2.4 cv=NsvhtcdJ c=1 sm=1 tr=0 ts=6a475691 cx=c_pps a=IZJwPbhc+fLeJZngyXXI0A==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=DJpcGTmdVt4CTyJn9g5Z:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=_y4YfpV96PzIBbQw7ZEA:9 a=QEXdDO2ut3YA:10 a=uG9DUKGECoFWVXl0Dc02:22 X-Proofpoint-GUID: mXtKtJ_tXTAekEDgoKpk_Cby3DWkv659 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAzMDA1OSBTYWx0ZWRfX1xfGctYXZajX 22f+9o8ndWrVYtuL1GDbNU+d3+fPAFccVvqZ4vBIkjUezA3Z9j7wlLGyfiUp52CC3vD7jtvlkJ/ 6IIi0epmKg+EJCcX8EtvIdjgiqU+Noddx3z4u082k0ZvUgLbjxXWKJ+UAQVtbU4k4/Xzvm9jm3N /C3dMongN1/n6XTmH16eDy2oX6ViehqIe2vyLhX4z/PG9VaPPuQSvuRPjc3/xqhXLmcxnGg6EiF 4f4rqTh1w2xPzKI4i8vAXqy07YcOY9p2nRwe9YESdJiZqJn7WHBdTosX2IWst9v6JRQR1HhXVbs yNkyKj+hpykiAmA587havT4+cdRSbih6qhyE/WR7C9TNhTkUvtPHVp/Lz9WMoW4VrOMEBlI82pp gqxOPMbqs9HcwDihOq0jFxbvn2AVW1pnW97z57F3nYDT9KYSExB1pMWQiCpQIx5fLBTkKWYobiI q+gR9LiKO1BYrfiz0fQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-03_02,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 lowpriorityscore=0 bulkscore=0 phishscore=0 suspectscore=0 malwarescore=0 adultscore=0 clxscore=1015 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607030059 On 7/3/2026 1:16 PM, Ekansh Gupta wrote: > On 25-06-2026 13:38, Jianping Li wrote: >> fastrpc_create_maps() performs map lookup only for buffer >> arguments (i < ctx->nbufs) via fastrpc_map_create(). For >> arguments beyond this range, no lookup is performed, which >> can result in duplicate DMA mappings for the same file >> descriptor. >> >> Additionally, if the same file descriptor is passed multiple >> times within a single invocation, performing lookups with >> reference counting would increment the reference multiple >> times, while fastrpc_put_args() would release it only once, >> leading to an imbalanced reference count. >> >> Fix this by allowing fastrpc_map_create() to control whether >> the lookup should take a reference. For arguments beyond >> ctx->nbufs, the lookup is performed without taking a >> reference, ensuring that existing mappings are reused >> without introducing duplicate DMA mappings or reference >> count imbalance. >> >> Fixes: 10df039834f84 ("misc: fastrpc: Skip reference for DMA handles") >> Cc: stable@kernel.org >> Signed-off-by: Jianping Li >> --- >> drivers/misc/fastrpc.c | 22 +++++++++++----------- >> 1 file changed, 11 insertions(+), 11 deletions(-) >> >> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c >> index a9b2ae44c06f..2622a1360a65 100644 >> --- a/drivers/misc/fastrpc.c >> +++ b/drivers/misc/fastrpc.c >> @@ -924,9 +924,9 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, >> } >> >> static int fastrpc_map_create(struct fastrpc_user *fl, int fd, >> - u64 len, u32 attr, struct fastrpc_map **ppmap) >> + u64 len, u32 attr, struct fastrpc_map **ppmap, bool take_ref) >> { >> - if (!fastrpc_map_lookup(fl, fd, ppmap, true)) >> + if (!fastrpc_map_lookup(fl, fd, ppmap, take_ref)) >> return 0; >> >> return fastrpc_map_attach(fl, fd, len, attr, ppmap); >> @@ -999,23 +999,23 @@ static int fastrpc_create_maps(struct fastrpc_invoke_ctx *ctx) >> int i, err; >> >> for (i = 0; i < ctx->nscalars; ++i) { >> + bool take_ref = true; > bool take_ref = i < ctx->nbufs, also add a comment stating why reference > should be skipped for DMA handles.> Thanks for the review. That's a good point. I'll initialize the variable as: bool take_ref = i < ctx->nbufs; and add a comment explaining that DMA handle arguments can reuse an existing mapping and should not take an additional reference, otherwise multiple references may be acquired for the same fd while only a single release is performed during cleanup. >> if (ctx->args[i].fd == 0 || ctx->args[i].fd == -1 || >> ctx->args[i].length == 0) >> continue; >> >> - if (i < ctx->nbufs) >> - err = fastrpc_map_create(ctx->fl, ctx->args[i].fd, >> - ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); >> - else >> - err = fastrpc_map_attach(ctx->fl, ctx->args[i].fd, >> - ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); >> + if (i >= ctx->nbufs) >> + take_ref = false; >> + >> + err = fastrpc_map_create(ctx->fl, ctx->args[i].fd, ctx->args[i].length, >> + ctx->args[i].attr, &ctx->maps[i], take_ref); >> if (err) { >> dev_err(dev, "Error Creating map %d\n", err); >> return -EINVAL; >> } >> - >> } >> + >> return 0; >> } >> >> @@ -1508,7 +1508,7 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl, >> fl->pd = USER_PD; >> >> if (init.filelen && init.filefd) { >> - err = fastrpc_map_create(fl, init.filefd, init.filelen, 0, &map); >> + err = fastrpc_map_create(fl, init.filefd, init.filelen, 0, &map, true); >> if (err) >> goto err; >> } >> @@ -2100,7 +2100,7 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp) >> return -EFAULT; >> >> /* create SMMU mapping */ >> - err = fastrpc_map_create(fl, req.fd, req.length, 0, &map); >> + err = fastrpc_map_create(fl, req.fd, req.length, 0, &map, true); >> if (err) { >> dev_err(dev, "failed to map buffer, fd = %d\n", req.fd); >> return err;