Metadata buffer is allocated during get_args for any remote call.
This buffer carries buffers, fdlists and other payload information
for the call. If the buffer is not reset, put_args might find some
garbage FDs in the fdlist which might have an existing mapping in
the list. This could result in improper freeing of FD map when DSP
might still be using the buffer. Added change to reset the metadata
buffer after allocation.

Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
---
 drivers/misc/fastrpc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 9666d28..8acdeb5 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -955,6 +955,7 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx)
 	if (err)
 		return err;
 
+	memset(ctx->buf->virt, 0, pkt_size);
 	rpra = ctx->buf->virt;
 	list = fastrpc_invoke_buf_start(rpra, ctx->nscalars);
 	pages = fastrpc_phy_page_start(list, ctx->nscalars);
-- 
2.7.4

On Thu, Aug 31, 2023 at 12:05:23PM +0530, Ekansh Gupta wrote:
> Metadata buffer is allocated during get_args for any remote call.
> This buffer carries buffers, fdlists and other payload information
> for the call. If the buffer is not reset, put_args might find some
> garbage FDs in the fdlist which might have an existing mapping in
> the list. This could result in improper freeing of FD map when DSP
> might still be using the buffer. Added change to reset the metadata
> buffer after allocation.
> 
> Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com>

What commit id does this fix?

And you sent 3 patches, but not in a list, what order are they to be
applied in?

thanks,

greg k-h

On 9/28/2023 6:38 PM, Greg KH wrote:
> On Thu, Aug 31, 2023 at 12:05:23PM +0530, Ekansh Gupta wrote:
>> Metadata buffer is allocated during get_args for any remote call.
>> This buffer carries buffers, fdlists and other payload information
>> for the call. If the buffer is not reset, put_args might find some
>> garbage FDs in the fdlist which might have an existing mapping in
>> the list. This could result in improper freeing of FD map when DSP
>> might still be using the buffer. Added change to reset the metadata
>> buffer after allocation.
>>
>> Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
> 
> What commit id does this fix?
> 
> And you sent 3 patches, but not in a list, what order are they to be
> applied in?
> 
Thanks for reviewing the patches, Greg. I'll send the 3 patches as a 
patch series for better understanding.

-ekansh
> thanks,
> 
> greg k-h