From nobody Mon Feb 9 00:47:15 2026 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 16D1E20E330 for ; Fri, 10 Jan 2025 13:43:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736516583; cv=none; b=AHfazIYj5PpmNwlliKzdc3at6hTM+CK6hRrbEh9UJthhDnLVkVdI/mOssE+u1bycMFR5ONRUZLtVRTzsJwLqm+nbVF5NgFkYZHeq9YeU5nThR37cWb75EgYocdnSgc4D0T6DRjMqNSk4u5DbtlUGvsWVaG3yqFbIhKTaoowDgx4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736516583; c=relaxed/simple; bh=Wu+a5bIbIwcIv9TD1viqdmPlsSpkGrPUrue4fXaag9w=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PS8ZaAwOXNRmr19zfEmBE226CnSLzGSEYtyEs2/Ys30q+NxVBrw8o6IV23CXxk18zc0t1X9/6IEWJzCMzRAt4ColSfU4psdJIINU6Uwc5DEVIgzqZmWKghxPmdDdqW11cTC4jbCTVzPRH+KRj7q8P+c/GO3CEaUqCUA1+qOzWCk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=OfGEJh9x; arc=none smtp.client-ip=209.85.128.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="OfGEJh9x" Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4361c705434so15598945e9.3 for ; Fri, 10 Jan 2025 05:43:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1736516580; x=1737121380; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=CBajPdeabGCrn1ggOOKGEX3EVH/OVTfMWYjlKB43k0s=; b=OfGEJh9xRrtMme2//Eqw3vkTXdlJf46wZhbxu5iEYYmrc9ILAdh+pHjs1zDNxmun0F /Lw/RMbgKqpKUomp8KY8ceFGhujfGL5h0N4pLaU1wKLxwtrTRZ/0M2K00wo76gjW0gjr wFS7G+1myQGjnlX/2EHDDfIt/P7J2CevxP8HOVi1R9JTHnFwQcwoNzSc0a0K2ETJoxrz U3M4DsPgH0ahIErLAUx68RFw9CwZVHGMrQZDxrkh5a0uwQNpVImumNsk/r2VFNKI4+pV e/2v3GBo7wa73y3n88LHvR0aeGkg2G2NfDExRC8kwjXBbws3oh4rfJ8zCTECWQAAnRRY KqWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736516580; x=1737121380; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=CBajPdeabGCrn1ggOOKGEX3EVH/OVTfMWYjlKB43k0s=; b=ckg3qIcLqqevCC0hJ3S7BA0lOUVWi5OwwGn7pBqKzkjRCjrGAaSbMQ7uLN5yKY3QFB Gp7cSu1EKC7vuDj3rbqki0GmJSX6APsQTydpHeXF1iZTi0TI1XSocceZGujeJ6lWrMUm 2hGTQaiUobXFK/Q1Mi2fpSREBM8Wl03V69V1mjg6sSHjoIgNxAI75TMn4KmORBLFZyrR w3C7anpIpUnn1HAam5ETdb2cdGGvUWQ877cxXh+okXYFjYKF7g6P2ZvQEjrQ+S+RKV+B RYsTzWQnRixeuqLolR4ckkiZUdTT4a6xJ4vTqUifaXVxg54hoO2+zqcvkT+fIFFKHLIp fnYg== X-Gm-Message-State: AOJu0YwsAypnPzrqe/WcE2c8qmncokjuxuajF0YNhsqFnKwOFhgZF7YB /+8Hq0ypkdFM2J5Lzkt8U7vfd2PvGumUjksDEJ42xD9i/nKeIQUt8nrm7SW7XpA= X-Gm-Gg: ASbGncvpHMfEhsILl+QYP9jjTUcEjupC0m2rm8ewTQPp0ZXjYsdln/oE6ChFLYIFvzl AH5kC2h7YREmK5DcTIVZ6P2gibzGP6tDnuC/3mZuDzPAHsuj5929gy1pe0j7fQp+ETd5Eani/qS /vPApE510ice/0kTEUHHBUE++HpgzCra0VB4NntM1S/yfOVgopUH9RzolrDgsIdd3L/+7uHpEsM MFS9VLgXu3Gl9vsmFSFgdLocaDr0BGehqYrYjFlKoUBJ35hKb6cFFUy6emdv4xoqlUHAHPgRgO2 +SQJFA== X-Google-Smtp-Source: AGHT+IGyfAOCaGk7ptEOj1u2bT5/BbKSeimPegg5dM/CmJ+nqybI026rMaLT6N3tDqEl0gwD6H2SBA== X-Received: by 2002:a05:600c:3ba4:b0:434:f3a1:b214 with SMTP id 5b1f17b1804b1-436e26f4af7mr79002005e9.28.1736516580351; Fri, 10 Jan 2025 05:43:00 -0800 (PST) Received: from localhost.localdomain ([5.133.47.210]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-436e2e89e14sm87584295e9.33.2025.01.10.05.42.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jan 2025 05:42:59 -0800 (PST) From: srinivas.kandagatla@linaro.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Anandu Krishnan E , stable@kernel.org, Srinivas Kandagatla Subject: [PATCH 1/3] misc: fastrpc: Deregister device nodes properly in error scenarios Date: Fri, 10 Jan 2025 13:42:37 +0000 Message-Id: <20250110134239.123603-2-srinivas.kandagatla@linaro.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20250110134239.123603-1-srinivas.kandagatla@linaro.org> References: <20250110134239.123603-1-srinivas.kandagatla@linaro.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1002; i=srinivas.kandagatla@linaro.org; h=from:subject; bh=b8oTMCJAkPTNlgKNxcfEiQDRN8EHSHhGtxHj65k0y5M=; b=owGbwMvMwMVYtfBv5HGTUHPG02pJDOmNyue3qGq1yFiVn/x458vq/wxHzVpFe73mXPP6lfvgV czPDQstOhmNWRgYuRhkxRRZlJ77Rx378+jbd7m7vTCDWJlApjBwcQrARVjZ/+kF8LDLnLhRFvB1 bfaF2W89K61tub/seVetl3VJ6ON1+8x8lWvx1/fPtVjzPs7GwV0tRv6FpO8USa6A0E95hws3F3z /YcDEZPTMIUvu09ply798m/Q139tMh8F76eboTdb51VvNs5dJXlIOvpChY3qmKvFO/uTcjU0tGV ++S7Xz//Hjj7nm/i49M6ii0e3Pq3mmObVVTZqux7haxc3tp0R21m6Nj+j/WzTdYml75hTDPsHMl /MWX7S6+CpMq/Tj/B2lr46d8j8XZR7An3BF9662mtFs71SREKVDJ141809+XN0WmqmawXFnmcky Ff+5z6+Jf2/lW7UpYM3T+O7jGeKfzxWmbvrn3Krr+tMMAA== X-Developer-Key: i=srinivas.kandagatla@linaro.org; a=openpgp; fpr=ED6472765AB36EC43B3EF97AD77E3FC0562560D6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Anandu Krishnan E During fastrpc_rpmsg_probe, if secure device node registration succeeds but non-secure device node registration fails, the secure device node deregister is not called during error cleanup. Add proper exit paths to ensure proper cleanup in case of error. Fixes: 3abe3ab3cdab ("misc: fastrpc: add secure domain support") Cc: stable@kernel.org Signed-off-by: Anandu Krishnan E Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 74181b8c386b..4a971e15d842 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -2344,7 +2344,7 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *r= pdev) =20 err =3D fastrpc_device_register(rdev, data, false, domains[domain_id]); if (err) - goto fdev_error; + goto populate_error; break; default: err =3D -EINVAL; --=20 2.25.1 From nobody Mon Feb 9 00:47:15 2026 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A87520E6E5 for ; Fri, 10 Jan 2025 13:43:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736516585; cv=none; b=dCBh+CqOccIZ5nJLnJRWSz8jUByHkRQ2QjesdUuBG07+zBpFzJ/mJODUGbUZCxhL9Qi9CNnfGCSxFp72qdJGtdqqza3G54upSMOKCz/cZT0Gu4G4p0jBW6pZuho4G1Lqq+Hjdj9QVu+Q+HkCaQgp0zh8Dh/OlQ2A3WRB5t9xD2Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736516585; c=relaxed/simple; bh=oBRbViGsjo+9//tesyPeMnUIZ2uDlpGOj+/95a2aO6Q=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=j6kL69Lb1ndJ4E/DxaxICDu7L6b3rsxbptcJ/EIlRGOUtJa1mTax4oVzry+51xQr1bMqJ770nyDgXyX44xgdyamRp9jqNvbFsWnUYdbbj2nt5405ZK+gDbGCcjLW3icIuzv8D9LtZdLAArlMVYICUqO/yU5zG03XfPeHFFbe6TI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=Lg5AJtVA; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="Lg5AJtVA" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-436341f575fso22231465e9.1 for ; Fri, 10 Jan 2025 05:43:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1736516581; x=1737121381; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=bsVYPyFwzz4xjTS4dQLxlrNi1uKC1eQyiHWIjy65XdA=; b=Lg5AJtVAByJUA5/hSu5zDybVg39DSdIef9O9lO9bP7IRvrFDDFz1yrmZVX7cO8Zyzv GnSGqP4PrPFxEmvAKg1ICSq/Q9y5NtanRck/Mv4aba8KEuwrvAk0x0TRQUs1FgPqEDWe +JcX2DDUY15/0Ef4V4CpeevH1GUiAA7l9oFqTmPR3YwKrKAb8trefSoqoz1D5WbyCqqU tBxl5/TKujHFh/GzMU4XsnWw76aVlHW+mBcZccP2SoFLxFM23iXZDVmJdZ2GfKDBwILd 0svprNlrpp1VPOGrF2WGXRyjOQb0enLPRM1cPovKujkjEeeWWirmoP5k4MX2Rc6gAPyF yPvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736516581; x=1737121381; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=bsVYPyFwzz4xjTS4dQLxlrNi1uKC1eQyiHWIjy65XdA=; b=vE/zkOThtXCMQIwNkEu5Afn9pmZp+o39Lw8OEY4a9dryDw2IRJo9MKl9mySwPDw8++ 4ao+4SG0Bfm+shF4yzV/Ap0W8YQgtSC/MjC9dQFRv7CqGRWXAb6MPvc1s0DFoMG2FeS8 +O9gZOZZGF/7agIeDuAa3/4uB/DUEXYHk9bLvVsQQVusTKg5xnxlFS6WK4LO0sIshEZA lX8Rs/RL6N/BalmuseGTXHlu/JeN6FYcC/bONoeBsJsAUUJlWOmb6+CKxw0jUJTB2Dpt 9eLDcHquFvGB35epvjEBXIei9Y1lKTMlL8PiX0EPO5JOX+6YtOJMlrLsCaeUV/W9G+3h ws4w== X-Gm-Message-State: AOJu0Yx6G5o1C9trraPocSkS3HmFL895PP62oGJ8WCXpd3KWuLU+p1pi KacFEU0fyAUuIf4isA78bwLuPjYRipbZRomMa6Uv4gPC7kMM9HbPf7exjvEd7Qw= X-Gm-Gg: ASbGncs4A6pLMKljX4G3XvwPjxumnMZEusLMyTIvPgclPfMyr7/ibsnrRv/6HfRwpPe xJuAjWbKda/prj2iJGJK+t/Kaz7bQrjR0flH+4hhbJGfnACnmQ/8VozA8kp75U94bIWnzPmQ637 TKQMEd/WpeRDLjVBxSv4eW8TGvi9f9pHDGRqM2/elVP7d18WfSd3kMg0EfkIRoJ2zLBjMYxXscu SMo5tVZmjZyvmzHrAU8Buh+abRl6D6cYkSpCZ/Omxn2ol5CfL0n8/dHqPF6dRND2Zz69LA5/zvf x0yk3g== X-Google-Smtp-Source: AGHT+IE2HEnTZWx0wB4TbxwXVcoultXiaxTF4RQ3DAdC7Ol3VWvcUk3vN/jPNA0DjtUBtbJKy4n3KA== X-Received: by 2002:a05:600c:a09:b0:434:f753:6012 with SMTP id 5b1f17b1804b1-436e26aa593mr110780475e9.17.1736516581599; Fri, 10 Jan 2025 05:43:01 -0800 (PST) Received: from localhost.localdomain ([5.133.47.210]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-436e2e89e14sm87584295e9.33.2025.01.10.05.43.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jan 2025 05:43:00 -0800 (PST) From: srinivas.kandagatla@linaro.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Ekansh Gupta , stable@kernel.org, Srinivas Kandagatla Subject: [PATCH 2/3] misc: fastrpc: Fix registered buffer page address Date: Fri, 10 Jan 2025 13:42:38 +0000 Message-Id: <20250110134239.123603-3-srinivas.kandagatla@linaro.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20250110134239.123603-1-srinivas.kandagatla@linaro.org> References: <20250110134239.123603-1-srinivas.kandagatla@linaro.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1876; i=srinivas.kandagatla@linaro.org; h=from:subject; bh=dFJwtxtocIbRba9qrGE+8E40R39qjMCDT8C5edJ34qg=; b=owEBbQGS/pANAwAKAXqh/VnHNFU3AcsmYgBngSPP7hYXeAhrwF5C//jqd3fK+grRaIcpsblB/ U/YDHd+bhKJATMEAAEKAB0WIQQi509axvzi9vce3Y16of1ZxzRVNwUCZ4EjzwAKCRB6of1ZxzRV N22YB/46zb/OBIh0An0/01KCRP1MMgRep0+mLbki555xGnhue87atTnRzZvzFlXO0k2nYM5DqKd VvLqD90c5vdSIG1TEGrQaR3Kp1esn3vOqjOQ2R0EB1xFChUVNmWnNMaWQJ8Jqel7/ZvZZb9ITQS dTcVvp9gn3ES8L5syVlCX7MYBMI2K5KheyHbAs/o4Ior+CSm6xu6QffDqGTaoAZtBVR2OCVMeDF gad3JX56A5NYu7S4NCvoq8RkkNDcLCxHPvTtoGbp97jzXj2it+wGP42ODPjRgAWHjGJ8WzI4bAz MWJe5FvWUyw87GzPuchDRXnVk/S6eWL8T8u1+VrUVE42CcrJ X-Developer-Key: i=srinivas.kandagatla@linaro.org; a=openpgp; fpr=ED6472765AB36EC43B3EF97AD77E3FC0562560D6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Ekansh Gupta For registered buffers, fastrpc driver sends the buffer information to remote subsystem. There is a problem with current implementation where the page address is being sent with an offset leading to improper buffer address on DSP. This is leads to functional failures as DSP expects base address in page information and extracts offset information from remote arguments. Mask the offset and pass the base page address to DSP. This issue is observed is a corner case when some buffer which is registered with fastrpc framework is passed with some offset by user and then the DSP implementation tried to read the data. As DSP expects base address and takes care of offsetting with remote arguments, passing an offsetted address will result in some unexpected data read in DSP. All generic usecases usually pass the buffer as it is hence is problem is not usually observed. If someone tries to pass offsetted buffer and then tries to compare data at HLOS and DSP end, then the ambiguity will be obser= ved. Fixes: 80f3afd72bd4 ("misc: fastrpc: consider address offset before sending= to DSP") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 4a971e15d842..891529aa9069 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -992,7 +992,7 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_= invoke_ctx *ctx) mmap_read_lock(current->mm); vma =3D find_vma(current->mm, ctx->args[i].ptr); if (vma) - pages[i].addr +=3D ctx->args[i].ptr - + pages[i].addr +=3D (ctx->args[i].ptr & PAGE_MASK) - vma->vm_start; mmap_read_unlock(current->mm); =20 --=20 2.25.1 From nobody Mon Feb 9 00:47:15 2026 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2929020E704 for ; Fri, 10 Jan 2025 13:43:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736516586; cv=none; b=SWfCSiOfbG/f6spe4gDdT8gFAgQyfuh85P5f2dhvUvcbNqUzXtNTxyTowx1KqTy3g632fqNBBHlQPpMGnuSA+jMhpEnSjUNuluBxFJkbND4z//IZMvz/DFWr/oPkYOWgaY8p7HMOL3QSUmugBQ3Gdzwose/SVmh9oevEqg0dkSE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736516586; c=relaxed/simple; bh=utEVLQxEGVvMNNK6gNpJ93BenYMQjczvtqNl4ArbmhM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=E55yMmqxRAjq4lVoQVxIWuT5krlMppfSKbk6OvfuPzwZxjPwZuF/vTvvfHfVsx9wPccYYfiEIdqCzfu25KGTBLBxrsF5MKcmHDHACPKK9PhZCIuXKa2u4XYSG3u4bayxTGha243/kx2Fd17yceELbDVetgXX33YVrtvvOMWCCMo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=sOo57NjM; arc=none smtp.client-ip=209.85.128.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="sOo57NjM" Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4361e89b6daso15680785e9.3 for ; Fri, 10 Jan 2025 05:43:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1736516582; x=1737121382; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=a5i/6NQGSZ6KHLmzkn6T2kUio76RGyO4d08djtw8DdU=; b=sOo57NjMVehQ7DCa+SOuT2fX2+/nAdcRoiNol+KEfd/1gQIsQWNFXHLEmvb16M6TWE RwOOoEZzz4ECQQwrFVAn1Seam/m8F+PZ1z4drgjN3JHhqIXUGWAOHFS1R1qWRUZzwuL+ h1AgvJiqe25GeCk+PNUKLdiAXW19zITwco+c154u3H4yifeHZrnbZyx7F0uS47C+EZhX m0NdIZKbUMa5I7jw2GxKaTPbV7zbUX7AQqmWdjQ5M296LMCR7EilVyFULQiqlduYAJ7R O0N3/xlwCUE2MuSSVJ/pBgp6NaO52jcWZniNEswyyImRAGQvWUSclisW3erX/vQCNfpf IETA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736516582; x=1737121382; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=a5i/6NQGSZ6KHLmzkn6T2kUio76RGyO4d08djtw8DdU=; b=ImqqwTv5V6NRf3P1FYLqUSIlETSc2Bz31ot+Gzdqb8GOvUS5HkuCHky++8wUtqY/NQ lUtBlL56DABPpNVqnpljFcNzwxCxluj80CXqXdotTj1q0ySGkFJuuvBJhs5zjgyW2+Qa JKzJA8P500SctKl6pvcLIkr5+zRAfxpgYvqV1i0b7vgAHutKnLNrI8I0FSs+kYDU0gqB EUf9i8KF1wcL/DdPcsHux6xRSkJ9ftV2hXI9iHfLLgWb0+KNifYq4U34j1SLOoyz+iex SM46uFZaEMZsgCMUqgpnLgwnBrHbxv2wl33J1GkSu6ysR2bXNiWDnajTa/qLt4ys6zEF fiZg== X-Gm-Message-State: AOJu0YzDSTDUdYoWX01JW4NS2/PFUlY0KU06b2s0+hsP1RY71thyMv2X Re229VlduP2rrhjPpBdXx7T/AmzRBlQ6HD6D44hx0xHLhx9p+6VhPeG6ALN2boOpSWZJ8QzbjzC o X-Gm-Gg: ASbGnct71CORVhiE4LX0A1Yj5k5D0dnZbWdNQEi3acfU7KPgJMLt9W+KdULq/VKWPLk T6wp4n+MoYwviY5X5ft2Hwa/qydHKRCajfNmz+HJOER5fF0n1w781X49eXHlFsn5vBFMQRKiN7y Ijx8kwPWCER5A72a3vAH0dRgEshAcp2m0KA77ASmIOeavDSxyF2dtmXN2V32L18umtOqpwsS1QI cFJz5zShB2xb55U4VylFSNtp6lHW4cah20StN6WXy9Dj3as8m7UEd443v7lTXI9mhuMDSFfNx8F dUlqhQ== X-Google-Smtp-Source: AGHT+IGPgeiEg07T4HbqZC3EP5uOkvX1UohvjygcaLPvSltRf8MAStXQbBbz6AVHSSL8L2qbrrjg+Q== X-Received: by 2002:a05:600c:3505:b0:434:a7b6:10e9 with SMTP id 5b1f17b1804b1-436e26a9045mr105977975e9.17.1736516582435; Fri, 10 Jan 2025 05:43:02 -0800 (PST) Received: from localhost.localdomain ([5.133.47.210]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-436e2e89e14sm87584295e9.33.2025.01.10.05.43.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jan 2025 05:43:01 -0800 (PST) From: srinivas.kandagatla@linaro.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Ekansh Gupta , stable@kernel.org, Srinivas Kandagatla Subject: [PATCH 3/3] misc: fastrpc: Fix copy buffer page size Date: Fri, 10 Jan 2025 13:42:39 +0000 Message-Id: <20250110134239.123603-4-srinivas.kandagatla@linaro.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20250110134239.123603-1-srinivas.kandagatla@linaro.org> References: <20250110134239.123603-1-srinivas.kandagatla@linaro.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1437; i=srinivas.kandagatla@linaro.org; h=from:subject; bh=pwBonUgs7qSy4WNiJvmj7gkdSwx+j7EPshMc++fCBYQ=; b=owEBbQGS/pANAwAKAXqh/VnHNFU3AcsmYgBngSPPh3tuJPKqcN+YETPuy972rCd25yd0UZnO2 3lkmUd/myGJATMEAAEKAB0WIQQi509axvzi9vce3Y16of1ZxzRVNwUCZ4EjzwAKCRB6of1ZxzRV N5jHCAC6PJ8+yh/e2AfxiKjrlbmvF06d1NXQfwAHuKK4xm/UZxGPeHZaB/LgiQqYmy9skhgcBU0 sjipGe8R3M+KcGVxKNihMWzfoEnGLJNIK7MxBwJgV5H6LoUhGCmojxuHMM2ZS3+N9O5G6YO9/XN kh2X6oqtj/i9UVj5gCE+p7H94N4Gc0PnVyliptyCy8BkTSIvrsULY38JCrcFXIKErIHNBAJLTcn Aq2egBpQL6ocLWLUkH7z6kwZgEoiLr+bWOKDQ8pGNERl7KihphAQDk6VBB0iABZmwjItL5yDml6 Sbq7QmHdAoBRs9Ul7o6pkbkjBILMrZmeWZtlWHMUa/ctDpuZ X-Developer-Key: i=srinivas.kandagatla@linaro.org; a=openpgp; fpr=ED6472765AB36EC43B3EF97AD77E3FC0562560D6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Ekansh Gupta For non-registered buffer, fastrpc driver copies the buffer and pass it to the remote subsystem. There is a problem with current implementation of page size calculation which is not considering the offset in the calculation. This might lead to passing of improper and out-of-bounds page size which could result in memory issue. Calculate page start and page end using the offset adjusted address instead of absolute address. Fixes: 02b45b47fbe8 ("misc: fastrpc: fix remote page size calculation") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 891529aa9069..e567a36275af 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1019,8 +1019,8 @@ static int fastrpc_get_args(u32 kernel, struct fastrp= c_invoke_ctx *ctx) (pkt_size - rlen); pages[i].addr =3D pages[i].addr & PAGE_MASK; =20 - pg_start =3D (args & PAGE_MASK) >> PAGE_SHIFT; - pg_end =3D ((args + len - 1) & PAGE_MASK) >> PAGE_SHIFT; + pg_start =3D (rpra[i].buf.pv & PAGE_MASK) >> PAGE_SHIFT; + pg_end =3D ((rpra[i].buf.pv + len - 1) & PAGE_MASK) >> PAGE_SHIFT; pages[i].size =3D (pg_end - pg_start + 1) * PAGE_SIZE; args =3D args + mlen; rlen -=3D mlen; --=20 2.25.1