From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8417830B52C for ; Mon, 2 Feb 2026 06:51:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770015103; cv=none; b=QTGZfjo783JUlyN4WKiP+6kIvCXOVLueBA+rEDN9Mw4q5GlvZq9iVcWoBrFMIRyDZs1ZfQbeuEoDVeDElm1MDDTP49J4wrM8C4ItylWGUXb11YES46+ctTPoBNJzxUe23eVVzUyEPD26hzY8y0uB/AJFtGb7XEpcw0IIQf9UvTQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770015103; c=relaxed/simple; bh=kTbxZrQjzUFG9K7bYjfDaz8Fc2XdnKXB7UdLG7fzWbU=; h=Message-ID:Date:MIME-Version:Subject:To:References:From:Cc: In-Reply-To:Content-Type; b=Iub8T5u7KalKtnKFUeC2AGi8OLr1iEqQu3r8NeRuLlD80qs1dedCwBQ3LNDHefVN0HutlM70hcHIoWcG8GdiTaFcIOdBUuQN/CnIcmX4KX3qGlRRkVeG5Te8nF1GsaFxbkuFCXGbZy2j3bxNUtte7tn+Fpdbyb1LfNJzkMo3JdU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=YtaQZ6BD; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=e+AWYqcK; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="YtaQZ6BD"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="e+AWYqcK" Received: from pps.filterd (m0279864.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 611NKYYj2751940 for ; Mon, 2 Feb 2026 06:51:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= LW+Vjy9g0Y98fAgbe4moCBUb0jVsnAO98d8+7XdroJ0=; b=YtaQZ6BDwB1qR2Xr La1SthXJHkC9C20AfiBA+3o4jo1537XCThbekjPBdnEXJkaKs11AVy620vOOg+7A QWZBeT/N1FsT+75nmVq0u/ZoFEwzw/gSaijnZ7pjdPsR4ZB45L1eiERiQUKu47GJ 7NNWcjBYVEPRh+w7m8/hu/6syHyAOE06G6NObtJO4l92ERq1IZqbNPQmWP6SO4vY wcp+As+6T09LFup0rtx2698zKWETFWAzyU3u5qEe0B/c0h0d2CHTZ6qneju8hRAc uluhGYgyEbdSGqzLwto/yTkG6wt7UsUnepDOwA6WBldizlGBBAy0ePyEbB/k5KIk 24aYOQ== Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4c1awdca37-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 02 Feb 2026 06:51:40 +0000 (GMT) Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2a8c54bbe46so82831195ad.2 for ; Sun, 01 Feb 2026 22:51:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1770015100; x=1770619900; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:cc:from:content-language :references:to:subject:user-agent:mime-version:date:message-id:from :to:cc:subject:date:message-id:reply-to; bh=LW+Vjy9g0Y98fAgbe4moCBUb0jVsnAO98d8+7XdroJ0=; b=e+AWYqcKyND5fxt+lETPUzt2W1preBvGM6x8ePCBRN70WrfoTjEJ1IMlWRF7xiZWL/ uMIZfwRIzIuWixo5w2t53GxVZLEke/Q6vb+k6ErgaOP0lpwLgoGguIjJMQgz4syebpkR pOuTlweDihp8kk46tudxSKGmfAu4jUJzNuuOimgn22VCQrB0P5+57/MzJOSamGM0bdij dG01y6t6jR+iKf36Fm1dKzmdfEIOH4p7ln2eBw4nMHpCzSVcM02V5/3VAJjr4iUbMxzQ sTzT+we11iAX9W2X7UatOQKsjm1CLgZ71P1kFg9nTUucR58UTjHZ9YuYMhPFs2Le3znd 7A/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770015100; x=1770619900; h=content-transfer-encoding:in-reply-to:cc:from:content-language :references:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=LW+Vjy9g0Y98fAgbe4moCBUb0jVsnAO98d8+7XdroJ0=; b=F8yLoDTJwYYNUphVfeDLGOqeAo8JLAHNsvXA3xKVzhqD8Fb9trOydk3AlqVjxwFi5+ Sq7jGCreAlVfKSSkFbQcztxc0y1IMaohsU548UD8d/17B+7SJnwssjc4rYhl8rJ8/7fY Pg8DD3kdI4KnQslzbb9uEDTs/j3Db8JFT+lRwnevpfjhk1Di21nuoP16dt8B0ZJOT410 LWZPWG/3TumfzDa5Kpln5EvVeh92JZTny8w6/PJLDLroE7emjm/7VDJY2b/j9diMOLJC BDkdobSXEqNIPTlguFY2SyCnapB8OUPTXDcMyuC1a7aAVTYIBMw7GQrrC2ZptRwUvcRA J9dw== X-Forwarded-Encrypted: i=1; AJvYcCVP5sq4ypntZkxWjhnC8gbsO/GDlsrAvIu6qk+Wn/Xj6XMfQduKmhJcUnAn887tXDPAx8Orf6SqImMcl6g=@vger.kernel.org X-Gm-Message-State: AOJu0Ywir23A4u/Go6K85P6y+l7BLsj7TyLaGcakYtlj7eURqHNgiEK+ ul8SbNtHxT9ef0o8SanHKBo8nJ/jvhjXI5D+RCBiJozITH8CG2Rm934r9SKb2wiaTZuv0wjj1ko dWShm6Wa5WbhzVbBu+X01ydXsmZsp7AwYKKIyjOHokoMRi7Toz18B8A/Ma95eu5GX1is= X-Gm-Gg: AZuq6aJF3UYb2MTsZHHuv0HOf0A2fuKTNLf0g2sjP20ROHzISgtG6FYBKJQC5tyxL7y iB9YpmtumzTk+XBoctwFY/L8X9Bm7oa8PkUgc3bCtaeE6tdjs4e0qDGUvN/NOYKAeW16LE06rQs czIzdePiIZYmJnNtUQvXIdv7VJKakcCUclCy3l2JEJ+Nhj0P/4zJGYbtqfIFSyMeez4x3vMCpur heAeMUGo4/wqpQEIUhftJPiPLCBUhme5MmjuRuM3d9oZ4e5D/l/EuOHxEpYkeZ40X053ikAW5Xs WB/9uVs8fHaL5o8gNdMoeONxtOt3JTJFIaIVJLsyaWhu0iPBuObaE++i1N1O/xsqSIVWQnaTzEs LSq+rWiAIkkBF2a0q9d/ZmZ/gCsooJcBgAUzraU2pZhuA+nykAXxVckIvuiK4OlzrESzyiQXqWz r+c7An X-Received: by 2002:a17:902:b107:b0:2a2:f0cb:df98 with SMTP id d9443c01a7336-2a8d96bc109mr75445975ad.25.1770015099996; Sun, 01 Feb 2026 22:51:39 -0800 (PST) X-Received: by 2002:a17:902:b107:b0:2a2:f0cb:df98 with SMTP id d9443c01a7336-2a8d96bc109mr75445785ad.25.1770015099472; Sun, 01 Feb 2026 22:51:39 -0800 (PST) Received: from [10.133.33.100] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2a88b3eecc5sm142880255ad.17.2026.02.01.22.51.35 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 01 Feb 2026 22:51:39 -0800 (PST) Message-ID: Date: Mon, 2 Feb 2026 14:51:33 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 3/4] misc: fastrpc: Remove buffer from list prior to unmap operation To: Dmitry Baryshkov References: <20260115082851.570-1-jianping.li@oss.qualcomm.com> <20260115082851.570-4-jianping.li@oss.qualcomm.com> <3p4quidza7rwxng74fxcfoflo62tgakl7hummwsqmisaqmkwwp@nae55u2ehza4> Content-Language: en-US From: Jianping Cc: srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org, linux-arm-msm@vger.kernel.org, Ekansh Gupta , thierry.escande@linaro.org, abelvesa@kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org In-Reply-To: <3p4quidza7rwxng74fxcfoflo62tgakl7hummwsqmisaqmkwwp@nae55u2ehza4> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Proofpoint-GUID: IoANHHkQDfFIEWt-k98HlAUlOg6Mzmsf X-Proofpoint-ORIG-GUID: IoANHHkQDfFIEWt-k98HlAUlOg6Mzmsf X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMjAyMDA1NyBTYWx0ZWRfX793p0JtBHfSI /586GE6aNwHVh2PdNe0QECQDQz9J8M7Biyjc92nK2dZUskAMnpRgvrXpRPypejbmgpK7BS5wKIU k0YTI4qy+AJQU6lrOswgA0TjiyEx0Yb1rKZng5zju43kaRkUOCp/Nq0+lB5ZwXzNtkDPRALAq5Z RNeit3s0hrMjHBk7L7FsFBloWZ+TGnDMXaMHFPzhYtM7WWQlK7ToVS/rYb7LFXyxJZJClL2K7ER 16ky5+XQS9lezDJfCVAl86rbaigSxgEtWEd4tjMq7BewFVZzucfFrgEk0rbV1rvCC40YzzO32+S xvgx8VqpIFbx+vwv2CuSI2MbzTVacDQbsq32RptC22Nzjugpke0WzU7lSR7ms0Gc2QlgMbcYCzu mI9qmIEE73VA5CFsVWRM464E22Ll7JflTnm2aLcz4p7qOazAW1NcP8ajKIbYzy1zO1o41ebASlH Z/Sp6I995ay3YoliuxQ== X-Authority-Analysis: v=2.4 cv=T8OBjvKQ c=1 sm=1 tr=0 ts=6980497c cx=c_pps a=JL+w9abYAAE89/QcEU+0QA==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=HzLeVaNsDn8A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=jMqK_s9pk_6wsJaoijUA:9 a=QEXdDO2ut3YA:10 a=324X-CrmTo6CU4MGRt3R:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-02-02_02,2026-01-30_04,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 clxscore=1015 suspectscore=0 impostorscore=0 bulkscore=0 lowpriorityscore=0 adultscore=0 phishscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2601150000 definitions=main-2602020057 On 1/16/2026 4:47 AM, Dmitry Baryshkov wrote: > On Thu, Jan 15, 2026 at 04:28:50PM +0800, Jianping Li wrote: >> From: Ekansh Gupta >> >> fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is >> getting removed from the list after it is unmapped from DSP. This can >> create potential race conditions if any other thread removes the entry >> from list while unmap operation is ongoing. Remove the entry before >> calling unmap operation. >> >> Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") >> Cc: stable@kernel.org >> Co-developed-by: Ekansh Gupta >> Signed-off-by: Ekansh Gupta >> Signed-off-by: Jianping Li >> --- >> drivers/misc/fastrpc.c | 28 ++++++++++++++++++++-------- >> 1 file changed, 20 insertions(+), 8 deletions(-) >> >> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c >> index 4f12fa5a05aa..833c265add5e 100644 >> --- a/drivers/misc/fastrpc.c >> +++ b/drivers/misc/fastrpc.c >> @@ -202,6 +202,8 @@ struct fastrpc_buf { >> /* mmap support */ >> struct list_head node; /* list of user requested mmaps */ >> uintptr_t raddr; >> + /* Lock for buf->node */ >> + spinlock_t *list_lock; > > Why do you need to lock this? Isn't fl->lock enough? According to the discussion in v1 patch: https://lore.kernel.org/all/p6cc5lxufmefeulx5bhlh6q6ivwluqf2muj3hu5e5526fsppuu@brcy6arm7epg/ The lock is stored in fastrpc_buf here. > >> }; >> >> struct fastrpc_dma_buf_attachment { >> @@ -441,6 +443,7 @@ static int __fastrpc_buf_alloc(struct fastrpc_user *fl, struct device *dev, >> buf->size = size; >> buf->dev = dev; >> buf->raddr = 0; >> + buf->list_lock = &fl->lock; >> >> buf->virt = dma_alloc_coherent(dev, buf->size, &buf->dma_addr, >> GFP_KERNEL); >> @@ -1865,9 +1868,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_buf * >> &args[0]); >> if (!err) { >> dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); >> - spin_lock(&fl->lock); >> - list_del(&buf->node); >> - spin_unlock(&fl->lock); >> fastrpc_buf_free(buf); >> } else { >> dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); >> @@ -1881,6 +1881,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) >> struct fastrpc_buf *buf = NULL, *iter, *b; >> struct fastrpc_req_munmap req; >> struct device *dev = fl->sctx->dev; >> + int err; >> >> if (copy_from_user(&req, argp, sizeof(req))) >> return -EFAULT; >> @@ -1888,6 +1889,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) >> spin_lock(&fl->lock); >> list_for_each_entry_safe(iter, b, &fl->mmaps, node) { >> if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) { >> + list_del(&iter->node); >> buf = iter; >> break; >> } >> @@ -1900,7 +1902,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) >> return -EINVAL; >> } >> >> - return fastrpc_req_munmap_impl(fl, buf); >> + err = fastrpc_req_munmap_impl(fl, buf); >> + if (err) { >> + spin_lock(buf->list_lock); >> + list_add_tail(&buf->node, &fl->mmaps); >> + spin_unlock(buf->list_lock); >> + } >> + >> + return err; >> } >> >> static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) >> @@ -1985,20 +1994,23 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) >> } >> } >> >> - spin_lock(&fl->lock); >> + spin_lock(buf->list_lock); >> list_add_tail(&buf->node, &fl->mmaps); >> - spin_unlock(&fl->lock); >> + spin_unlock(buf->list_lock); >> >> if (copy_to_user((void __user *)argp, &req, sizeof(req))) { >> err = -EFAULT; >> - goto err_assign; >> + goto err_copy; >> } >> >> dev_dbg(dev, "mmap\t\tpt 0x%09lx OK [len 0x%08llx]\n", >> buf->raddr, buf->size); >> >> return 0; >> - >> +err_copy: >> + spin_lock(buf->list_lock); >> + list_del(&buf->node); >> + spin_unlock(buf->list_lock); >> err_assign: >> fastrpc_req_munmap_impl(fl, buf); >> >> -- >> 2.43.0 >> >