From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A1EC2EDD6B for ; Mon, 25 May 2026 09:34:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779701683; cv=none; b=Y4cF4XZUfn2/0bBMwJhQr/BxHb4BFaJPVDBbn1n80ko2PRgP/Uj187K+XcWKLd692A2JDw7RAcE4fDXW76EoeIVmWgyV/WXG1n+P6D1WDo5CQ2awI8Nvpz5Qb9zxLev9Ng4BG8a7CkoFVGoAzt+u04ifAONJhgfTf4HcNn7yy58= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779701683; c=relaxed/simple; bh=4rPV+ZGV/3V3cojckC6VpTU8/mUjIdJFtaWs+wpBmpM=; h=Message-ID:Date:MIME-Version:Subject:To:References:From:Cc: In-Reply-To:Content-Type; b=I67I9styFqvo6Tg2swSIg3bPOp+GXCnV4y8Cl6m0dIIt2MJCm9Z89WNqki1cIZ+8nakklQIhmZK96AtT2Q8XTTh94NxtfzKoPdmILqPEQzz/Qr3xcPN8VkJJa21Mvzz/UQnX0Ax4OC/d1uGIgCF4K/kPzoOCKmEJEH83iUjcs/Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=PVE2wz5G; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=ACwz2g9d; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="PVE2wz5G"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="ACwz2g9d" Received: from pps.filterd (m0279862.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64P9EQOc079348 for ; Mon, 25 May 2026 09:34:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= HDdyvgPHBYm4Smh+LW+i3c/LYOm4H7fTfg/6tMvRWrA=; b=PVE2wz5GcIfFLFz5 arx7gYTN9h5jQFTkVdyHfb6M4R95MtY4AWmM3tnMtXBnivfLUe5/2YDDX81T8bSl TQ5Kl+MfoxuhfIWZNc+VBZAn8AjAmC/ad3Z6p8tJKlzE3vqZ4xTir+96i1sPlU19 HbpXL/SpxER4dZfW7P/95JzRLo4ZUW/afwvPBS7x20G7tXqIPPddQNly6HFoXImG w54B3VIw//+Ka/AeDbBeuW3mA2RAoYLyrc2807M7aFEorUr634961Cv808hC1AzE Jkix5Ev2ja8oEl4CddQq+FyQBJWmzOdZ/zMltlFT0rtjeTXbnwtj5SPVzzEEZM/W Rpxr2w== Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4eckma82rv-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 25 May 2026 09:34:41 +0000 (GMT) Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-c82ac893940so4497689a12.1 for ; Mon, 25 May 2026 02:34:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1779701681; x=1780306481; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:cc:from:content-language :references:to:subject:user-agent:mime-version:date:message-id:from :to:cc:subject:date:message-id:reply-to; bh=HDdyvgPHBYm4Smh+LW+i3c/LYOm4H7fTfg/6tMvRWrA=; b=ACwz2g9d2GuVs8ueRrhG4Xv75ffC5AD4Z73eAAnZBBP5286/rY4LN79MpuACFiZgaj H8v1Ivto6jWcEgtnVkRnR1pnLivkmIuFWJ+VS3bKbLIIDQ1mZ7CfX8MVOQKDQHfsahQV z9k52qFiSy1HYhLhz0Tq00uteeruP+hhRxTQSOepxTyh9hY1AUQl3H+7IeuRGDHPcugp F92fD/HxTxG8ErgoVTEoXsuK9q9M9+i2DAd0ErNzRhTeU9598pl1wC6VlybMAHKVGJym 0CgIblratmtajoD0CQUkyu1MTs7IFZlIdWwKSdOOYWCtngho97+dUeCUliDwYodJfvka WbAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779701681; x=1780306481; h=content-transfer-encoding:in-reply-to:cc:from:content-language :references:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=HDdyvgPHBYm4Smh+LW+i3c/LYOm4H7fTfg/6tMvRWrA=; b=r3C90zPZCS1kfN+YJ+4wdzp9bwCvsilnCm99KpQxzO9TeyDBu0CKNKpHhPiRoHf5+k msQ4wjiZ4pCGBBrglKu25I/WBTpr3+Kq7AxWIaf562IREz1QUny9Wc24I0sYAnum9Fjn WTL1JJ3dqvZEpYZ6UiAhlLT0V/8SLC1OW7KvX5hJZIdHxuXfOBOYFcoCRUR/HrH8CDdN UBFnEZnNBq3AroErKBSSatjZHncY4lXp8c9lZYuUudORS4DNF7sJ6A68dedSLiJzYAiT psj/9NJZCP5cqWdSdwBr+N663Sgdyz8X0xJNyG4+9kB/jGhP44PaxbWntTWvocANceH7 0Xrg== X-Forwarded-Encrypted: i=1; AFNElJ9YDCaEIGzty9Zu1v+PnH4PwoQxW4s526Ohpr302T+961M/SgMrbs2fylXLY9XgTuhsxu7AX04+bLwYQA8=@vger.kernel.org X-Gm-Message-State: AOJu0Yz2TxpyDNFk0bdpg2Weh/BAU5ir8HJgIPLBO1AQ/Jtk2dbhGQ++ sjSoEtJfwIzN08cJWuLYPvBVpVELozLpUxZ8qQhm5cBK/1h84/EbnivkkOeH82PVjBHsXXPvYfL WDWlJamu/OwXtfpoBIfVdJRw8xH+o23pnYJbvSb1tBYaH2CxRr4Lr7Xg8AYERMPkUae0= X-Gm-Gg: Acq92OH996YJZ9oxopzlzgd26uLOo2BfSamU8ViCpeJJCOnSGeTJQDyQG6ROFYeEg+E 1pLJL1aFxeNkOWcHxvhs81dIHslTk11s1X231IGwPxlruQ2EgBoO1TZNsuJJngxAIITThMg/n7V EFQE0Rep8TLwvnky90RMF8SafXqvU7csSnBVhk8L+Ym2Ifmsn/9LnGdZQQldUfzvGKgwNzCambo umbGI5R5Q09fpfXZyNeelM26BVNvbvw75OSgjp5wCwe4xPCKk6Kjeu7ad5R+KFlP2UjxuHRpAHG lulAw91wVO2PS5e/0BcyWkBRacAsR5jmC8ODlZtGqOsMgrrxkMA7GcOOI17117Hb0A3/BKvVgca snkZfP775p5B0/c6d4LqvAz3w02jCCvX+qM6ZCbYsVKh3hzPsHwpDzC/SyyBjLDe/uXZuPRucQK p+BDI9/RIDmKM3UT73wHGiKgGsL9k= X-Received: by 2002:a05:6a00:3e04:b0:82a:7471:eb90 with SMTP id d2e1a72fcca58-8415f66c854mr14233883b3a.30.1779701680812; Mon, 25 May 2026 02:34:40 -0700 (PDT) X-Received: by 2002:a05:6a00:3e04:b0:82a:7471:eb90 with SMTP id d2e1a72fcca58-8415f66c854mr14233849b3a.30.1779701680195; Mon, 25 May 2026 02:34:40 -0700 (PDT) Received: from [10.133.33.215] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84164ac9e1fsm11160434b3a.6.2026.05.25.02.34.36 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 25 May 2026 02:34:39 -0700 (PDT) Message-ID: <85c2bfd1-8e69-47e4-a360-10a2655bd43f@oss.qualcomm.com> Date: Mon, 25 May 2026 17:34:34 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v5 2/5] misc: fastrpc: Remove buffer from list prior to unmap operation To: Dmitry Baryshkov References: <20260515124217.20723-1-jianping.li@oss.qualcomm.com> <20260515124217.20723-3-jianping.li@oss.qualcomm.com> <37146a3a-b18f-40f1-b95b-0ac19bf6c07a@oss.qualcomm.com> Content-Language: en-US From: Jianping Li Cc: amahesh@qti.qualcomm.com, arnd@arndb.de, Greg KH , abelvesa@kernel.org, jorge.ramirez-ortiz@linaro.org, Ekansh Gupta , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Authority-Analysis: v=2.4 cv=cL3QdFeN c=1 sm=1 tr=0 ts=6a1417b1 cx=c_pps a=oF/VQ+ItUULfLr/lQ2/icg==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=NGcC8JguVDcA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_K5XuSEh1TEqbUxoQ0s3:22 a=EUspDBNiAAAA:8 a=UrbuGVNNhqs0kg2t1zgA:9 a=QEXdDO2ut3YA:10 a=3WC7DwWrALyhR5TkjVHa:22 X-Proofpoint-ORIG-GUID: y4Sn0oOg69a3AapRfuE1RG7_PmHPGEvP X-Proofpoint-GUID: y4Sn0oOg69a3AapRfuE1RG7_PmHPGEvP X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNTI1MDA5NyBTYWx0ZWRfX2umnMkkgbqoH +aNcKFpAspMQM6Fo8h5d+9m5NqbrN92gI00M/ELBJTLUTxoxPIovDtcXxHVqedO/po+Trll7NFW G9K424AESgMJhyrdb2MjPSm4LeHIIHHqD+m1WrTbrc8bJD5xiGzZYNgtTOuRPWERL7oh5K+x2F6 rAa/Tgxqi6YEFeZTlVJMAmYPltjp8TubyB50CZiFhRewSstNRlx4vnavqPoVqW7/qkJjMKxWEEY 41/eQ9Go+5sXSo+Q4TSKPjfdM/KrtzyywHj1o7FFuR/1XJeJLJ1jMRKaPL26NwciqLOoO5nYxm5 B9AECYoOl3QVAgk6RGCSMAgSWP3KLR1B/5VsLslfPj4mcHvSHnujLg8fEO9qCNkLFP2wnysmCkB RpawEN3v8ILtldDEhZJk0MdYmGQpM9lm4EmVHIPlfsy9ogN4Y5dw3ohDy4ClfPG++fEtBLj4sdf WwwZ1/1C8raAx9g/6ZQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-05-25_02,2026-05-18_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 bulkscore=0 priorityscore=1501 phishscore=0 adultscore=0 lowpriorityscore=0 spamscore=0 suspectscore=0 clxscore=1015 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605130000 definitions=main-2605250097 On 5/25/2026 4:30 PM, Dmitry Baryshkov wrote: > On Fri, May 22, 2026 at 02:55:29PM +0800, Jianping Li wrote: >> On 5/15/2026 9:36 PM, Dmitry Baryshkov wrote: >>> On Fri, May 15, 2026 at 08:42:14PM +0800, Jianping Li wrote: >>>> From: Ekansh Gupta >>>> >>>> fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is >>>> getting removed from the list after it is unmapped from DSP. This can >>>> create potential race conditions if any other thread removes the entry >>>> from list while unmap operation is ongoing. Remove the entry before >>> How can it remove the entry from the list? >> Multiple threads sharing the same file descriptor may invoke unmap concurrently. > => commit message > >>>> @@ -1898,7 +1897,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) >>>> return -EINVAL; >>>> } >>>> - return fastrpc_req_munmap_impl(fl, buf); >>>> + err = fastrpc_req_munmap_impl(fl, buf); >>>> + if (err) { >>>> + spin_lock(&fl->lock); >>>> + list_add_tail(&buf->node, &fl->mmaps); >>>> + spin_unlock(&fl->lock); >>>> + } >>> Is it expected that userspace tries to unmap it again? Or why is it >>> being added to the list? >> User process can call unmap and fastrpc library won't call the unmap again. > In the other email you wrote that the driver can be used by random apps. > So... what happens if userspace unmaps it again? What if the userspace > _doesn't_ unmap it (although you've just readded it back)? If the same buf is unmapped again, because it has already been added back to the list, the unmap logic will be executed again. If userspace no longer performs unmap, the driver will not unmap it proactively. The Fastrpc driver will free up this list during fastrpc user-free. > >> Fastrpc driver will free up this list during fastrpc user-free.