From nobody Sun Feb 8 18:24:32 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF1C31E2823 for ; Tue, 13 May 2025 04:28:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110517; cv=none; b=Ro5r07sWbajDRP/Q2k3wA9zU+YohAvgn/YGGhBady+4STL0T7hCq8SyVohRweXGJN/3nCmRKFv71gMt4lkdo+bJJwschZaB93U40O1oDK2BG8Psk/VHAMSuLWD4xGvaOddzSDcR6eQqIIu4fY1jDEBlbRqTTndALg1VNkQCMBJA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110517; c=relaxed/simple; bh=lVZ470qAXY14EXPU6lTKjuSsb5rLHlyTi7oAECx0L/g=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ahbcvFyIOfLM5AhxvZ/le8mhP7fRYb+AMwmpsMI8n2ObaI761tU58+ILxAHrzYllQDeLAbrDEkxDdmYUxjDsSnIqZ6wBvCrOy84XkBkg266NmFsvcd3fsXifNJp83ft47ppSllGul239FG94zKpOWO3BTpZTqIMUPeHQcijCar0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=fyERwcWy; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="fyERwcWy" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54CJY29Y013136 for ; Tue, 13 May 2025 04:28:34 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=0Wt0GbBUNwU U3CBX0BKb99qSKLR+tWyMkIzj1AQsy0Q=; b=fyERwcWyxHKMuCu8oqpW3wonN4B 9+mQ1tI14fOldzaUEmrqzTsn2qabSdnVCBtrNDL39guRPjh1A4ITtTgUgAL+ABwP PgqyOhaIFsUqtGfXYti67R7U2TE6vQBxD6sG7Yio7cia/sdM1OeHggJUflYeTSWx 1h137inJP4oTVAolZ/yI29NrKreEXO5iXeQ4r+KIbPnDrzdhwGCh4u1SS6M/u+Cs q1GGJxfILQMmWFjzcKDmU3GQvEEQH7SkP6JCAvJg2xzJPA0HiuhgVdzB1pcTdnmV yWXZPup/XU5iMQWnqocsOQiDBVF0HuW7qF9GQODGv3JK65sIjllO8OuefNQ== Received: from mail-pg1-f198.google.com (mail-pg1-f198.google.com [209.85.215.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 46hx4k6e3r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 13 May 2025 04:28:34 +0000 (GMT) Received: by mail-pg1-f198.google.com with SMTP id 41be03b00d2f7-b26a7303e15so1011585a12.2 for ; Mon, 12 May 2025 21:28:34 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747110513; x=1747715313; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=0Wt0GbBUNwUU3CBX0BKb99qSKLR+tWyMkIzj1AQsy0Q=; b=LWDY5ix+B75Z2pD33OOmX2yEPap0z3KEuAUkcRZbDtfNXAFKU7VoeEUy+guwpUJaG3 pSiRAFiBXBtdFCMeH2JyUpHEG/aZPkCcncYvEAaCRkJikpwV/qvZ0xjw/j+My3WTwl09 1sL+uTK4iL1Ig7z/BzwJG3PNAinmmd7t+DaXxrmNAXeOML4/GBDhR1U5ARA3J2IDx6f/ IfNEmwUH/SxgKKOBEYWyxtv60b3IoorK4DkpYIsFUS7h+1Qhnh0cIDFYnK4Ks5eZBuCj wws1HT0E1Nj7CuzTElFCrE7swbKZKHz6nUYJJYBtkkKWF/6aEuTv8TqMQHaYICuFey9+ hByw== X-Forwarded-Encrypted: i=1; AJvYcCWQNAu25oGpKYH6XLz+lvUB73NBj6gm9xswUNU3rs+aWvKDh5u2tqfXEx5uIYxVuOoz+OvmCqP5gJDDxHI=@vger.kernel.org X-Gm-Message-State: AOJu0YwvshQG/VNsoQLvjC/xyuyWuPo8MQaUOL7pYIApQkf2Ey61YSlv D/3mealM0GjlG+8ZjyAVe6TASZvFdmQOQxo9V3pZR2YsG4R7jlFtTB4N0YcsYV6iukVMGKQDJnm zUr9HvPlLSL7FqQxkI/pyPAkSLpgBAv01WaVT8S1VMfJo6Qu3A1QK1N5j4BnNjMc= X-Gm-Gg: ASbGncvGzD2wkdxHLRsfEAYbpK7bEw2hNGDuPnkYwVQ4qYI+P0ArOoph6m5masMd2KK /sEsRg74XcCxRP48c6adod7kQthYh54UMgenQ4uQyif2fr0JhjaLs0xHkHUIqwvJFvExW6QLwfA r9h1AaVY7Kh+2Czc9hh5GmpDxcO/GRCBrdZKO9uaxH2z7WLHy5gaKsk7zIBEaJhpxuC72K6t4G5 0Q76vmCD3XnG8gl9UJrDHoSYrkQpzFGK4riIllDPSKGSmnmVtJfhUzIYkVaBJfkAfuzfUKo5eLR 3+r6LKTyYo8c+cCkwAJ4ArTEvEE45LWsoNFjnR7j9q2u X-Received: by 2002:a05:6a21:648c:b0:201:8a13:f392 with SMTP id adf61e73a8af0-215abb3a036mr22831423637.20.1747110513041; Mon, 12 May 2025 21:28:33 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHtAZDS57gaeo6+l2GKtDyxXJDhvCrMInic2QuKuXWsVSU5v5nDoqK57ZyLXWaJ0MLUYJUb+w== X-Received: by 2002:a05:6a21:648c:b0:201:8a13:f392 with SMTP id adf61e73a8af0-215abb3a036mr22831397637.20.1747110512674; Mon, 12 May 2025 21:28:32 -0700 (PDT) Received: from hu-ekangupt-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b234ad3e9f1sm5486101a12.35.2025.05.12.21.28.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 21:28:32 -0700 (PDT) From: Ekansh Gupta To: srinivas.kandagatla@oss.qualcomm.com, linux-arm-msm@vger.kernel.org Cc: gregkh@linuxfoundation.org, quic_bkumar@quicinc.com, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, dri-devel@lists.freedesktop.org, arnd@arndb.de, stable@kernel.org Subject: [PATCH v1 1/5] misc: fastrpc: Add NULL check to fastrpc_buf_free to prevent crash Date: Tue, 13 May 2025 09:58:21 +0530 Message-Id: <20250513042825.2147985-2-ekansh.gupta@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> References: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Authority-Analysis: v=2.4 cv=ReqQC0tv c=1 sm=1 tr=0 ts=6822ca72 cx=c_pps a=Qgeoaf8Lrialg5Z894R3/Q==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=y_gjuFtE12-Q3iuIhokA:9 a=x9snwWr2DeNwDh03kgHS:22 X-Proofpoint-GUID: lE8HjN8rtn60k00DH4CKbZFwAErzRvJ8 X-Proofpoint-ORIG-GUID: lE8HjN8rtn60k00DH4CKbZFwAErzRvJ8 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDAzOSBTYWx0ZWRfX0q0x+poeYAMh kISeojFP3ulOrScp5q+iSjSu5dl/CzqAOrZmHoQ4j9Mr37BoFeVGaSDrYUxtC7f08Tz/xCvgDys jnPxeHz2xYLapz0d6vxBRrfWO3LuuUrxI2U+s2WxU7CjVaRhlnXW0uFs/5IFH6342NrS+9Vg3xt mZ+vshS7435NFGaCXAeC95/pBTvBNRMO5UxNqz+jqDRqP+Hs/SRnwDbd7Ul3kyvJyJ+M+hyLGIZ ozha/pciKKS4NSojECUF5F1rgfnapfGTsuq4iGVSRyNl1oPcou8a+uyKAnYZGkPBFHasf8UpRoX u5Av6hlCa2SQqUWi+CU391NuwDfcYHmxrFsXhKlWIGQXSruxMHeOu+VLBzVBEQDggU05UHDtx4K +8O2BRPrHx0K4xZc8dHS3uWoP3jXM/qY2bmPWew+V4dJnDirlhQ8DdGTZAIRv/rcss7IqY7x X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 mlxscore=0 mlxlogscore=999 phishscore=0 suspectscore=0 spamscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 clxscore=1015 adultscore=0 malwarescore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130039 Content-Type: text/plain; charset="utf-8" The fastrpc_buf_free function currently does not handle the case where the input buffer pointer (buf) is NULL. This can lead to a null pointer dereference, causing a crash or undefined behavior when the function attempts to access members of the buf structure. Add a NULL check to ensure safe handling of NULL pointers and prevent potential crashes. Fixes: c68cfb718c8f9 ("misc: fastrpc: Add support for context Invoke method= ") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta --- drivers/misc/fastrpc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 7b7a22c91fe4..ca3721365ddc 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -394,6 +394,9 @@ static int fastrpc_map_lookup(struct fastrpc_user *fl, = int fd, =20 static void fastrpc_buf_free(struct fastrpc_buf *buf) { + if (!buf) + return; + dma_free_coherent(buf->dev, buf->size, buf->virt, FASTRPC_PHYS(buf->phys)); kfree(buf); --=20 2.34.1 From nobody Sun Feb 8 18:24:32 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 174051E5710 for ; Tue, 13 May 2025 04:28:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110521; cv=none; b=aSrcbT9Puh5q/wNyerUY0AxAGBRUrlhldITmVuLrGHtLvBctOtg+1zYz0FOLMITgzPPHqI0YnaTVJSDzc1A7LWfZIt9ztsIjGchBAffBDI96uhs/pIbfBVExqiQX3jgS/DZ6QQJaYz9bx/wWms5AnVwTY8Fw0mTtFUhVA8M5hpI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110521; c=relaxed/simple; bh=oWCR1gkWJ5Ozp3f18wS0ekIwbkaN21aXHvSV+DM+JQ4=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=dO0K41RSjqWnmuzrysGOA1Eh0uYw+jgnmjDaxRmiUXiRsNoi72+viSfMLx8aAno3SWOwtpBAniY147i6/tGFj91ATeb2demBAox+93FG78WOx0Mpsfi45rSIOXLrZtJIEg0WyvoHefiNN+jgz0uwVsyKSbZopzgzbIadG+bbob0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=Go2jo/RJ; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="Go2jo/RJ" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54CIlB0k017020 for ; Tue, 13 May 2025 04:28:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=JBKTYpKkO0p hGBWecSjnY+M4MAGQXCre+WzNfXWOMeU=; b=Go2jo/RJcASnyPTMxi28UiOJHE+ SC4BRR3zurlF4R8nyXhDKqzYuXg9nU4tvauuqyUD17R4FGIs8Nki9N6j1P6Tzo50 q3Z/ktRsskwiWu/Y3ImSGv+/RN5khHkZbETNcR8woFHOHV2YDHAIEuk4Gq+ulnkM mB8+1lLwxESyuB32jcVZMjUvL/uaWbm2l6do36inizGNaY5Z9AAI0H0nSQU70v+D 2+KekcmNq2gESWZvC11U2P/HE5BaihZ9TEkSlr+w3UPjByk7S+uVFQs5DZykXhHv fdXOYKVSKTIoa8oujTAAyGyBTGXtu9kFielc+cPZu0z3C6UvWdSAjxXXLng== Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 46hwt96drm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 13 May 2025 04:28:37 +0000 (GMT) Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-af534e796baso2922632a12.3 for ; Mon, 12 May 2025 21:28:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747110516; x=1747715316; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JBKTYpKkO0phGBWecSjnY+M4MAGQXCre+WzNfXWOMeU=; b=vjd7HRZ+NCEIzU9Zlo+GPeCM8DTZkG2u6r1cMk9DWv9GZZW1FLCPFnnjmE+UP5s7EC 0EYJGfa268aFk04zIMINLWOs5hhbw23Zf+GBiwHWwq8j5zcvhhM/dcwfsXyNDa1Kv9Rt getz0AeOsLlKi01PFiPPwjaPMB+c4mHO6JAum6s8jfC/ZYqIJg0qhMw4XsdMUdJKp9R7 E30ci8RjWDVMuDCC/N6Yu8u60qG1TWd5rz5OT0sCEgE/u+F0yJdRtHwUzeYEuIT/Ytto csTWKODs8w80aLMnsKijiDeW18/OYoABYlKvAztYXaNCk57ySxGZYIyWv5RHrOyZgmak bHiw== X-Forwarded-Encrypted: i=1; AJvYcCVr8fClt/DFTXlNx28xHF+f3taBWYnh3cgjiZGOzKI7q43Lzgw46kncme3INGuKvvrCJFMmjCY1UVaSJ4I=@vger.kernel.org X-Gm-Message-State: AOJu0YwmSbFUCGkfMBoBpgzSHA9O+7dTr8E8X3u0DVJPhODmt/6JZYEl UKonRVVvuvGCxA5d0MWD/GEZ+hfbCuELcuonDkz/tef0vuURfZDmlakgjKWYr4A2HxWjDu3VUnj DlvZRtTi185agoJNRqSIdWnu9e9ulg972bxgtVmLP8+5GKHai1M/cyb8/L5qiPJo= X-Gm-Gg: ASbGncsNgeiRX4ZZeRrN8gCamcAkW0Sle+3FSODR/baq/flQHj1igy9PeRKc9jdYccP bcxhbXZU+P8xxZqOUiD4EOAYe9r3GRSIFm492ER5RWW5eL6B9GjO1HeL3OsO7PL8P1odaTgvCP0 q3OwzsQnpypRjH2I+GD3QfLdGb7OxOb+O1AYvRuJ/95rJ5FpY3RCn5RSfyVXq7y7hv5WwKySrcr HjCwdno4+Fs3EtFACjVdep6l2W2c3wKmABxwxiKfd7tFTsMmqEMNO0zo3QtWd0gGuJiNB7VQc3l h8VikjT6lteRvzLVy0t8TqtuWZO9F8UPc+Sr+nN64f0U X-Received: by 2002:a05:6a21:329f:b0:215:df62:7d51 with SMTP id adf61e73a8af0-215df628053mr5732966637.11.1747110516379; Mon, 12 May 2025 21:28:36 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGj8cGPKXqDpWef9yIeurebhtNZT+H7Bmo9NepDU0xQBRo7bKnmIjazNK/c1Ygs924EivHqHQ== X-Received: by 2002:a05:6a21:329f:b0:215:df62:7d51 with SMTP id adf61e73a8af0-215df628053mr5732941637.11.1747110515935; Mon, 12 May 2025 21:28:35 -0700 (PDT) Received: from hu-ekangupt-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b234ad3e9f1sm5486101a12.35.2025.05.12.21.28.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 21:28:35 -0700 (PDT) From: Ekansh Gupta To: srinivas.kandagatla@oss.qualcomm.com, linux-arm-msm@vger.kernel.org Cc: gregkh@linuxfoundation.org, quic_bkumar@quicinc.com, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, dri-devel@lists.freedesktop.org, arnd@arndb.de, stable@kernel.org Subject: [PATCH v1 2/5] misc: fastrpc: Move all remote heap allocations to a new list Date: Tue, 13 May 2025 09:58:22 +0530 Message-Id: <20250513042825.2147985-3-ekansh.gupta@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> References: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDAzOSBTYWx0ZWRfX4emrcAR8sflG SMl3fNMr33mGh8U1NGWSBxuIse/7vQsamwhjU0IVouRnAsAA1P7F7WQWtIAGdNnR7+v0uddsRmH pWLmsxqS/3PFRMzYmPvP293iRNl1/UVIW7miodUBBKhoeGTOOO/Wm8SCDWtA2f2O4rGl5HlmxZd mXwdLnqsbvoQR83Y5flPcSPe/azq89her05xHSilO7bFJ1qM0aBaVT5MKjiNZR/2nngZYXc3vtf 6dRkybnKLLFf/1p47ISit/xeLbAxHMwFR/c5WtlnU2OrgZwKRLyDinE+vcZcGZPgtsN6yKXEMin rf1oCvQgHRxkZdwJaZjvyJ9z/DCXR/NjPGPBP0f0gEaMRMtCVhYYtS9I5vPqE97KF1F+QOJOkmo om24jBStO3RxEcA5/s3H67om/sOyJzL/yuIyaN+C8ckck671/SBO7Ft6GFMMaypP0/wOFnF8 X-Proofpoint-ORIG-GUID: B7VwAnBqi_9q9HBdGks0OvryrqbPr99S X-Proofpoint-GUID: B7VwAnBqi_9q9HBdGks0OvryrqbPr99S X-Authority-Analysis: v=2.4 cv=a58w9VSF c=1 sm=1 tr=0 ts=6822ca75 cx=c_pps a=oF/VQ+ItUULfLr/lQ2/icg==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=8PHFzVjbKYy-BIK1PrEA:9 a=3WC7DwWrALyhR5TkjVHa:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 phishscore=0 lowpriorityscore=0 mlxlogscore=999 malwarescore=0 clxscore=1015 impostorscore=0 mlxscore=0 spamscore=0 bulkscore=0 adultscore=0 priorityscore=1501 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130039 Content-Type: text/plain; charset="utf-8" Remote heap allocations are not organized in a maintainable manner, leading to potential issues with memory management. As the remote heap allocations are maintained in fl mmaps list, the allocations will go away if the audio daemon process is killed but there are chances that audio PD might still be using the memory. Move all remote heap allocations to a dedicated list where the entries are cleaned only for user requests and subsystem shutdown. Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta --- drivers/misc/fastrpc.c | 93 ++++++++++++++++++++++++++++++++---------- 1 file changed, 72 insertions(+), 21 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index ca3721365ddc..d4e38b5e5e6c 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -273,10 +273,12 @@ struct fastrpc_channel_ctx { struct kref refcount; /* Flag if dsp attributes are cached */ bool valid_attributes; + /* Flag if audio PD init mem was allocated */ + bool audio_init_mem; u32 dsp_attributes[FASTRPC_MAX_DSP_ATTRIBUTES]; struct fastrpc_device *secure_fdevice; struct fastrpc_device *fdevice; - struct fastrpc_buf *remote_heap; + struct list_head rhmaps; struct list_head invoke_interrupted_mmaps; bool secure; bool unsigned_support; @@ -1237,12 +1239,47 @@ static bool is_session_rejected(struct fastrpc_user= *fl, bool unsigned_pd_reques return false; } =20 +static void fastrpc_cleanup_rhmaps(struct fastrpc_channel_ctx *cctx) +{ + struct fastrpc_buf *buf, *b; + struct list_head temp_list; + int err; + unsigned long flags; + + INIT_LIST_HEAD(&temp_list); + + spin_lock_irqsave(&cctx->lock, flags); + list_splice_init(&cctx->rhmaps, &temp_list); + spin_unlock_irqrestore(&cctx->lock, flags); + + list_for_each_entry_safe(buf, b, &temp_list, node) { + if (cctx->vmcount) { + u64 src_perms =3D 0; + struct qcom_scm_vmperm dst_perms; + u32 i; + + for (i =3D 0; i < cctx->vmcount; i++) + src_perms |=3D BIT(cctx->vmperms[i].vmid); + + dst_perms.vmid =3D QCOM_SCM_VMID_HLOS; + dst_perms.perm =3D QCOM_SCM_PERM_RWX; + err =3D qcom_scm_assign_mem(buf->phys, (u64)buf->size, + &src_perms, &dst_perms, 1); + if (err) + continue; + } + fastrpc_buf_free(buf); + } +} + static int fastrpc_init_create_static_process(struct fastrpc_user *fl, char __user *argp) { struct fastrpc_init_create_static init; struct fastrpc_invoke_args *args; struct fastrpc_phy_page pages[1]; + struct fastrpc_buf *buf =3D NULL; + u64 phys =3D 0, size =3D 0; char *name; int err; bool scm_done =3D false; @@ -1252,6 +1289,7 @@ static int fastrpc_init_create_static_process(struct = fastrpc_user *fl, u32 pageslen; } inbuf; u32 sc; + unsigned long flags; =20 args =3D kcalloc(FASTRPC_CREATE_STATIC_PROCESS_NARGS, sizeof(*args), GFP_= KERNEL); if (!args) @@ -1273,26 +1311,30 @@ static int fastrpc_init_create_static_process(struc= t fastrpc_user *fl, goto err; } =20 - if (!fl->cctx->remote_heap) { + if (!fl->cctx->audio_init_mem) { err =3D fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, - &fl->cctx->remote_heap); + &buf); if (err) goto err_name; =20 + phys =3D buf->phys; + size =3D buf->size; /* Map if we have any heap VMIDs associated with this ADSP Static Proces= s. */ if (fl->cctx->vmcount) { u64 src_perms =3D BIT(QCOM_SCM_VMID_HLOS); =20 - err =3D qcom_scm_assign_mem(fl->cctx->remote_heap->phys, - (u64)fl->cctx->remote_heap->size, - &src_perms, - fl->cctx->vmperms, fl->cctx->vmcount); + err =3D qcom_scm_assign_mem(phys, size, &src_perms, + fl->cctx->vmperms, fl->cctx->vmcount); if (err) { dev_err(fl->sctx->dev, "Failed to assign memory with phys 0x%llx size = 0x%llx err %d\n", - fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err); + phys, size, err); goto err_map; } scm_done =3D true; + spin_lock_irqsave(&fl->cctx->lock, flags); + list_add_tail(&buf->node, &fl->cctx->rhmaps); + spin_unlock_irqrestore(&fl->cctx->lock, flags); + fl->cctx->audio_init_mem =3D true; } } =20 @@ -1309,8 +1351,8 @@ static int fastrpc_init_create_static_process(struct = fastrpc_user *fl, args[1].length =3D inbuf.namelen; args[1].fd =3D -1; =20 - pages[0].addr =3D fl->cctx->remote_heap->phys; - pages[0].size =3D fl->cctx->remote_heap->size; + pages[0].addr =3D phys; + pages[0].size =3D size; =20 args[2].ptr =3D (u64)(uintptr_t) pages; args[2].length =3D sizeof(*pages); @@ -1328,6 +1370,11 @@ static int fastrpc_init_create_static_process(struct= fastrpc_user *fl, =20 return 0; err_invoke: + if (buf) { + spin_lock_irqsave(&fl->cctx->lock, flags); + list_del(&buf->node); + spin_unlock_irqrestore(&fl->cctx->lock, flags); + } if (fl->cctx->vmcount && scm_done) { u64 src_perms =3D 0; struct qcom_scm_vmperm dst_perms; @@ -1338,15 +1385,15 @@ static int fastrpc_init_create_static_process(struc= t fastrpc_user *fl, =20 dst_perms.vmid =3D QCOM_SCM_VMID_HLOS; dst_perms.perm =3D QCOM_SCM_PERM_RWX; - err =3D qcom_scm_assign_mem(fl->cctx->remote_heap->phys, - (u64)fl->cctx->remote_heap->size, - &src_perms, &dst_perms, 1); + err =3D qcom_scm_assign_mem(phys, size, &src_perms, + &dst_perms, 1); if (err) dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx= err %d\n", - fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err); + phys, size, err); } err_map: - fastrpc_buf_free(fl->cctx->remote_heap); + fl->cctx->audio_init_mem =3D false; + fastrpc_buf_free(buf); err_name: kfree(name); err: @@ -1869,6 +1916,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, = char __user *argp) struct device *dev =3D fl->sctx->dev; int err; u32 sc; + unsigned long flags; =20 if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1937,12 +1985,15 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl= , char __user *argp) buf->phys, buf->size, err); goto err_assign; } + spin_lock_irqsave(&fl->cctx->lock, flags); + list_add_tail(&buf->node, &fl->cctx->rhmaps); + spin_unlock_irqrestore(&fl->cctx->lock, flags); + } else { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); } =20 - spin_lock(&fl->lock); - list_add_tail(&buf->node, &fl->mmaps); - spin_unlock(&fl->lock); - if (copy_to_user((void __user *)argp, &req, sizeof(req))) { err =3D -EFAULT; goto err_assign; @@ -2362,6 +2413,7 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *r= pdev) rdev->dma_mask =3D &data->dma_mask; dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32)); INIT_LIST_HEAD(&data->users); + INIT_LIST_HEAD(&data->rhmaps); INIT_LIST_HEAD(&data->invoke_interrupted_mmaps); spin_lock_init(&data->lock); idr_init(&data->ctx_idr); @@ -2420,8 +2472,7 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device = *rpdev) list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node) list_del(&buf->node); =20 - if (cctx->remote_heap) - fastrpc_buf_free(cctx->remote_heap); + fastrpc_cleanup_rhmaps(cctx); =20 of_platform_depopulate(&rpdev->dev); =20 --=20 2.34.1 From nobody Sun Feb 8 18:24:32 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7DBE1E51E1 for ; Tue, 13 May 2025 04:28:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110524; cv=none; b=GIBnjpYHYJVIq6+rsoFTCmfEDMygkwhQ40zbG/pKrwxkLRtKeSgqcY/H2N3l2xzgo76uMFrkFirNPpc9yhHaKV1NPf908MXQPSF9xGmFb8a+9byf/+siczPw3zNIiuKJ7PmJKLBdkvq84lLvmKWtSHO+Ipc6McjuMTr6hAk/B0A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110524; c=relaxed/simple; bh=ZqxErHXIh7dPrWcetdQxxPBTtJ2e+XLBRN9zKxPHcDQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=CNUF0IEXn5hmypc7YLgFdq+kaZiWvuV6hUjmdrECdL0KjIDgilIxF02OcQvrKyK870M+n8LGQnG7QgX7U5duTasSiIPRg41xR7Ki5iZjijuSS20HVzYr7wGRf8OG8srSsVaR2Bpp/yH1aqDqKUUoy6++R04/iQUPmFt6H80AK3w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=eBy3rIC2; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="eBy3rIC2" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54CHYRou024078 for ; Tue, 13 May 2025 04:28:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=80VSBrnaMRJ WWQG6HQKfwi1RurptGFsnclEszCS2EMo=; b=eBy3rIC2NAX96Zdk7fuJsOzUt85 6ifwrIy5+rpygd58PYr8tVmvWfS+Cpto09Uu/Sa1OU0/7jmYM1pcq5wkupMT+m5r Mh9aVUVXLCqTvmM8k+IVIDE1m6IUqhf9PTw8mwsihps3kPnlMrNOvp1mauVIPkYx JlLFxJaYTb0GWnVc9vpOak5iCMQtb7Ldkg9HV8ctBlFqfkZ3Z7a/i8vf9uxhqnso 6L3AGbHGk+lmwHU+nqNwsqKkgccFH1XnUUsh1ZEg1RrAOmuROOZQX5rfcADN7t70 XMiF6GDxx6KPYMoos1wLT8y1Kw8MznrGSxTmwOWP7U9YAHn8jS7ePRCqWsA== Received: from mail-pg1-f198.google.com (mail-pg1-f198.google.com [209.85.215.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 46kdsp2m9d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 13 May 2025 04:28:40 +0000 (GMT) Received: by mail-pg1-f198.google.com with SMTP id 41be03b00d2f7-b23d12e14bdso3954959a12.1 for ; Mon, 12 May 2025 21:28:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747110519; x=1747715319; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=80VSBrnaMRJWWQG6HQKfwi1RurptGFsnclEszCS2EMo=; b=I2O06AJeKHNib7yDVv9GwbSRg+xLZZYyVZ+bVPohtO99lLkZWCAUidKx9g60jD/FUq bS3n9s6zDSMATq5oFkwHfbv9lejVhM8HtahD2BFAX2mkc4fsdBug9Pl9+i4k701XhYF3 mUVJzhV5gYb5gMvhF9QDFxAYqeoV2an2cu1KiqVQSPyPfTgCgWz/wA12Q+Qp4KBqikWy kGB3UuGrx38DgvQpFCKTod71oBh/aGUsFDE72VZkKBP2NF2fVxVlC2BZfM+2uo7XP1V4 SxobkMiVXJOTC3i0EcKYLQY/VIf99r+NQhmySSEmkdowtHbSPsaLORR7m4bm8oc9YQiM NUMQ== X-Forwarded-Encrypted: i=1; AJvYcCVCQ94oPo7Xv71YvnTYc3PTG0KtYgoqSAKbkGPDeZ+aRg4A98+qMNbuedHflAEzgf2tCBDnYdzPIVQsLdU=@vger.kernel.org X-Gm-Message-State: AOJu0Yy4ngjKTf6SZc0mp0h6mGctVhVBG14YeLc2df0IgVZfZMkCpfc3 CxVUhqRj4ObbvQ0fxznXzZbfqbctVZn4DXYKMlzhegaC5C6fi2Nc4fpWLo1/SQy9TdLCACc8bdh DlQuJL5yufEZbXhs4bH0L73dJI3/OR7xNdq157zPJawb69vW++HhiJRyyrkfgYK0= X-Gm-Gg: ASbGncvPf3RvrYGxs1JV39IjprUyUWNJF3mYpfq9wvIRQ1aat1FMtBgOXDsWjKX4KkS ainYDnyeclepWjz9z0zBEEEzv6z11KSihP7VScSxDUat86MX0LWXO3FQ2blKRVwmlfuDuwbL1BN T+CnLxgVmVcgD5KGGhFuJsQaUQLXoiei+OJP61L/F2AOpPWNlVMIIsaLHHEA+PS+EIETgP9B1t4 kZzMLMmrfLv8halDjS7erD/kIlt+9V9x7WxAQctm6c6GZAKSlWgVa0oz1hqwaobST7+112xj+in yKzIUlajhBfm1nLtnWINZUdP7BX318plgeizDDCHwn3S X-Received: by 2002:a05:6a21:458b:b0:1f5:70d8:6a98 with SMTP id adf61e73a8af0-215ab883667mr25224173637.0.1747110519624; Mon, 12 May 2025 21:28:39 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEkhTKa1aIjIDArtHetshGQTFyREicJBCEr0fG8qbpWn0Htg+JAbubSWvVsCfvyg9O9E3J4Ww== X-Received: by 2002:a05:6a21:458b:b0:1f5:70d8:6a98 with SMTP id adf61e73a8af0-215ab883667mr25224141637.0.1747110519205; Mon, 12 May 2025 21:28:39 -0700 (PDT) Received: from hu-ekangupt-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b234ad3e9f1sm5486101a12.35.2025.05.12.21.28.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 21:28:38 -0700 (PDT) From: Ekansh Gupta To: srinivas.kandagatla@oss.qualcomm.com, linux-arm-msm@vger.kernel.org Cc: gregkh@linuxfoundation.org, quic_bkumar@quicinc.com, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, dri-devel@lists.freedesktop.org, arnd@arndb.de, stable@kernel.org Subject: [PATCH v1 3/5] misc: fastrpc: Fix initial memory allocation for Audio PD memory pool Date: Tue, 13 May 2025 09:58:23 +0530 Message-Id: <20250513042825.2147985-4-ekansh.gupta@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> References: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: 8VroCzUNP1mtEMCcZZx4_0kXvrdKOyje X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDAzOCBTYWx0ZWRfX59N48Tem3Yvk pxyQJOhgNKrd5USYAjjY8KyDEYAG8xB7/GSmY/JHZbOhQNS+aSpppX+f9sROw9u+eR2n/p6942/ Lzu6TO17oUucbxUiQF7RFDi3A9s/7DTkkB0rJ4GnUrKl0DhQudrc9+0zn3oCxCsVaxNYxZacMbm Uy0rhSPDCNrp/EJHftWH6LEvSuMzJA45PQhyYQiKGgU6pTeLzbsjj8uMbkKQ2voNHOI9c4G7QeX kZkU+a0Hckimi4D2wr7RNZ1KNuz47mIqJhFROjMMabmTS+q4QxDUGt8SS1EuA/xKR1Yn1JpGImH mRK7K3hB4uqq/qhRpKyQerryGzl0SQZgx/WaZb7+tCHZOoAl3LN1JpfY6Uxt77108umDU7zcNuC YeuZRFVLBTUBab3V//1ex6xoHE8G5Opyziw7uykEUADB8eOLMf4okaGjHTDxdLDnAugGihD1 X-Authority-Analysis: v=2.4 cv=TrfmhCXh c=1 sm=1 tr=0 ts=6822ca78 cx=c_pps a=Qgeoaf8Lrialg5Z894R3/Q==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=l_23c2mIThvE2ntJpuUA:9 a=x9snwWr2DeNwDh03kgHS:22 X-Proofpoint-ORIG-GUID: 8VroCzUNP1mtEMCcZZx4_0kXvrdKOyje X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 clxscore=1015 spamscore=0 malwarescore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 lowpriorityscore=0 adultscore=0 mlxscore=0 impostorscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130038 Content-Type: text/plain; charset="utf-8" The initially allocated memory is not properly included in the pool, leading to potential issues with memory management. Set the number of pages to one to ensure that the initially allocated memory is correctly added to the Audio PD memory pool. Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta --- drivers/misc/fastrpc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index d4e38b5e5e6c..b629e24f00bc 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1311,6 +1311,9 @@ static int fastrpc_init_create_static_process(struct = fastrpc_user *fl, goto err; } =20 + inbuf.client_id =3D fl->client_id; + inbuf.namelen =3D init.namelen; + inbuf.pageslen =3D 0; if (!fl->cctx->audio_init_mem) { err =3D fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, &buf); @@ -1335,12 +1338,10 @@ static int fastrpc_init_create_static_process(struc= t fastrpc_user *fl, list_add_tail(&buf->node, &fl->cctx->rhmaps); spin_unlock_irqrestore(&fl->cctx->lock, flags); fl->cctx->audio_init_mem =3D true; + inbuf.pageslen =3D 1; } } =20 - inbuf.client_id =3D fl->client_id; - inbuf.namelen =3D init.namelen; - inbuf.pageslen =3D 0; fl->pd =3D USER_PD; =20 args[0].ptr =3D (u64)(uintptr_t)&inbuf; --=20 2.34.1 From nobody Sun Feb 8 18:24:32 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 677591E633C for ; Tue, 13 May 2025 04:28:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110527; cv=none; b=g7q0ormFYUaDVEUjOYHDRA0v0kjXswk43HDs0kbcl6WL/nF3g+IsKnCsnuQi8wAr+P68u/ROfSZmHx3w2Z4IMHbmQD5M2NpmMzLw6BNeBENtSXBFt+BUkjx9slAa8n4hjDDMDwyfRR3IzEaACs4FPHG0gA0tRiv4kuZov8eRwSk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110527; c=relaxed/simple; bh=219mGIdybJeDtz8GQAmZgDg/UcfEorRh98P57NlV1zE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=b3g0DUfrf38XmD6jdmlBau1yLLqE0m5oF+WxB8Qhkzhz35pSv4JSO4399JlDPZoY6sUwJKJwWy8jpNIW3JGLT1H1Tkphfs/pxDmniStRHUD1xs7FpxtHI1XRu0JHtZP42Rd2JNxZyLdIaN7Wk+tOvHBNltJIeWGG2nMPlLcaSdk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=LycLwXlt; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="LycLwXlt" Received: from pps.filterd (m0279870.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54D11nCt029278 for ; Tue, 13 May 2025 04:28:44 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=W6GAILZe1jq 2FdYPLrjjokTUXGgsX3z5BCNlHC9cgZU=; b=LycLwXlt7RoCmNdFiYWyOvk/9/U hkFK/hXQ+w36NMnBW3d1QMc26PrmtSz01Eey4sN5jZck4qRvLu8ECoUcUPqRJRMI itULNwyPdkLVrwgLJFGSVnl/gBq8LqGFzNbb8MfBA0jIKwEDFYF3IcOc9ucy0T9f AOw8Oo/uD+/5oELDmC1uXN4dPv5J2YSt6pgiO/4HCssP6u4mnbFzEws1XveLyws3 gwDICGWS9pFhp/fzoXF2+/kTyVbp+1P3qnJ4ug58T+5gPnQbF0c4Oit9EtgJSvlr T4KPg/kklSbM2wBgJ3ktk9Ku2twY+EoQZpktb5V8Dld+NXx0l5henjbXuow== Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 46hxvxeckq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 13 May 2025 04:28:44 +0000 (GMT) Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-b2431e45064so4404507a12.2 for ; Mon, 12 May 2025 21:28:43 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747110523; x=1747715323; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=W6GAILZe1jq2FdYPLrjjokTUXGgsX3z5BCNlHC9cgZU=; b=kpXehh2lVt8kRU3Ace9xG00rGdSaDe8YtqJ7w8pD8LFstyMiF1GqGOY3xNw4UBhsr2 yZWHnyPV2vsDPo4EYgUX/32vGtFo2o5FnHJ+YvI4441H3UpgwuNRnqjOrXk0shKW9ePo iE4RDnfggZoY2ui22DV1nHV7Uwip9ZKvj1L+fQXStEvvOWRwc4WLxup+58aFegvWi5Ik +gEN+8VAdGtTnFa1qeNmpOfAQxv3CF4xCJdzgEC3G1klpghunt9wAxww27lKFtDuSAaB k5CcJHgn/qJwRMejUBc50rKK9cp4+amKfV4ZaXj/NoO2ZIMbdhnSf0L6yBs9Onz2PrNW qj5A== X-Forwarded-Encrypted: i=1; AJvYcCVqr4q7MNsHsFFVRy1YBgy/JErNGASREVbi/GFxFiwxAvkFCyt/A7X7nFsX4ROVYbgw3fcHn+EIoFzx1jU=@vger.kernel.org X-Gm-Message-State: AOJu0YwoEyL6vYC6Au/RxTzyQefJnjboDUE3Iy5Rfas5Br7Ho7aDF9ry aD/oxPjvHhdTyl4I8loItkPyMnokq2VVbZWc55ZgmsfK32l+d47eZh1LWM/4Xu9Qakyd7/INJH4 eSSbP3xV5YN1GcCKBCufrgbonn3CkgZes+sD7Mw37beQQRXljAuOT53Tm2AsRx7k= X-Gm-Gg: ASbGncsmr6GfLr2bcpvqMfMhQraKsBj/N7WQjdf9SbHu6EdMDFPST6naeessTsJl/Ud KOQYmAOzNfYTtbue8iRtYwh334/EwPwu+gPQAlwv11Y5/r2b9pFE9aMwPQKEwhzSU6cPI+hr8Wu 7lFVvtEnEWBI03e0ajVmVLXiDcUljlcqGQBBU0mbS4ioeGrVoZjhir2kby/lzzlgP0Ai1pOHNNs Q/VUXyPchAUFiqQLJ9vJfX7vxmqXyt7gt+tnVQSuCPXVtRPLN7otbO9yzyWqed7w88DD7Zx85wh snX2p3Qswez237YNGGgmUBtH4Ozsla91As9KotxocUoD X-Received: by 2002:a05:6a20:1124:b0:215:d565:3026 with SMTP id adf61e73a8af0-215d5653229mr6842195637.20.1747110522848; Mon, 12 May 2025 21:28:42 -0700 (PDT) X-Google-Smtp-Source: AGHT+IH4+gbSS6s7qSuU5YmGTKTsPTB3m3lJGYEwqEPy9irPtLLKsH0Ru/ril7XSm2s95m5IamjdpQ== X-Received: by 2002:a05:6a20:1124:b0:215:d565:3026 with SMTP id adf61e73a8af0-215d5653229mr6842165637.20.1747110522505; Mon, 12 May 2025 21:28:42 -0700 (PDT) Received: from hu-ekangupt-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b234ad3e9f1sm5486101a12.35.2025.05.12.21.28.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 21:28:42 -0700 (PDT) From: Ekansh Gupta To: srinivas.kandagatla@oss.qualcomm.com, linux-arm-msm@vger.kernel.org Cc: gregkh@linuxfoundation.org, quic_bkumar@quicinc.com, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, dri-devel@lists.freedesktop.org, arnd@arndb.de, stable@kernel.org Subject: [PATCH v1 4/5] misc: fastrpc: Remove buffer from list prior to unmap operation Date: Tue, 13 May 2025 09:58:24 +0530 Message-Id: <20250513042825.2147985-5-ekansh.gupta@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> References: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDAzOSBTYWx0ZWRfX3CPIOXe5/8vF fpeuEOIksqSkAlId0o6ywIvCMugGYpZRfO8wE4fUsIjHzpRJRBh/nE4pM55/Dh4VFvajZE6mXBP h27qqFiZgxISBaGPXkl9t/wBwM/NkzAUvkiyzsGT7UJd4HLxSgEiMPGupOtvisiUSZnrJPEm0a2 wZY6ecTlTEtk3qwUdwhzI8t6NZpxBU9CCt4LMqdb3+TScT4X12jU7yqtO+gKKJADmNkdC/sOglT 4sFZeataGwXcgmAY+nGWMYlred4sW+VLJzsyB4OlQK4Kh/zZUFEyvINi9HBDxrcScVLv2ghO/xC vCyjk1iTdlNy8e4y89saegvhJQ5DU5eJ0pQsyyEvMi64lUQwTSWLieICGhySB3AMEoxQtXV2/IA N/Z7L6c6i9hbKYZfqVsqU1Df0FVzz3bie8BfaTF71POHZd7FcRF4XBsoACC29lQLRd1D4GOb X-Proofpoint-GUID: 8BEm8Mj5dvtGzKXN_xfgZbeK258DnDCV X-Authority-Analysis: v=2.4 cv=WMV/XmsR c=1 sm=1 tr=0 ts=6822ca7c cx=c_pps a=oF/VQ+ItUULfLr/lQ2/icg==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=BnVeGx0dmUjw97O46OEA:9 a=3WC7DwWrALyhR5TkjVHa:22 X-Proofpoint-ORIG-GUID: 8BEm8Mj5dvtGzKXN_xfgZbeK258DnDCV X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 adultscore=0 lowpriorityscore=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 impostorscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130039 Content-Type: text/plain; charset="utf-8" fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if any other thread removes the entry from list while unmap operation is ongoing. Remove the entry before calling unmap operation. Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta --- drivers/misc/fastrpc.c | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index b629e24f00bc..d54368bf8c5c 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1868,9 +1868,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_use= r *fl, struct fastrpc_buf * &args[0]); if (!err) { dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); - spin_lock(&fl->lock); - list_del(&buf->node); - spin_unlock(&fl->lock); fastrpc_buf_free(buf); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); @@ -1884,13 +1881,15 @@ static int fastrpc_req_munmap(struct fastrpc_user *= fl, char __user *argp) struct fastrpc_buf *buf =3D NULL, *iter, *b; struct fastrpc_req_munmap req; struct device *dev =3D fl->sctx->dev; + int err; =20 if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; =20 spin_lock(&fl->lock); list_for_each_entry_safe(iter, b, &fl->mmaps, node) { - if ((iter->raddr =3D=3D req.vaddrout) && (iter->size =3D=3D req.size)) { + if (iter->raddr =3D=3D req.vaddrout && iter->size =3D=3D req.size) { + list_del(&iter->node); buf =3D iter; break; } @@ -1903,7 +1902,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *f= l, char __user *argp) return -EINVAL; } =20 - return fastrpc_req_munmap_impl(fl, buf); + err =3D fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); + } + + return err; } =20 static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) @@ -1997,14 +2003,23 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl= , char __user *argp) =20 if (copy_to_user((void __user *)argp, &req, sizeof(req))) { err =3D -EFAULT; - goto err_assign; + goto err_copy; } =20 dev_dbg(dev, "mmap\t\tpt 0x%09lx OK [len 0x%08llx]\n", buf->raddr, buf->size); =20 return 0; - +err_copy: + if (req.flags =3D=3D ADSP_MMAP_REMOTE_HEAP_ADDR) { + spin_lock_irqsave(&fl->cctx->lock, flags); + list_del(&buf->node); + spin_unlock_irqrestore(&fl->cctx->lock, flags); + } else { + spin_lock(&fl->lock); + list_del(&buf->node); + spin_unlock(&fl->lock); + } err_assign: fastrpc_req_munmap_impl(fl, buf); =20 --=20 2.34.1 From nobody Sun Feb 8 18:24:32 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A06631E98EB for ; Tue, 13 May 2025 04:28:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110531; cv=none; b=umYiZeRD4SqsqZ4g4Y8pkiDEkH0Ly7TDxd5U5kGF6L1L9GUWLOTfvRh9p73Y1HDcpAUBYHKRLrrfPqK185dFlFcPdOzDOugKIaro7aP1mg8+baUHTGvak2hGTR5X8jgur8fFEcN2xfcNLR+VBUcpAhBcwtFailLougLpeMxxauc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110531; c=relaxed/simple; bh=b/jdrld+JHj+dMZXOOpKT68s1sxFCgElAgmgr19swG8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=EhWnS+vP/kgaatrg+Mj9LUn94VXusJNYdmByYlETPldUVKrI8ZcxC5u0EjMx/uh7covkpDAZclzVqLs4ewYHldQec4Sogvrn5vsfpwEjcgEeHL52GT4qF3zdFeINau7d0vn/j+Bumotd6SNye6/6KMIEWx8r74cYvP2DNqEDy/I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=clTGICtS; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="clTGICtS" Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54D3Y1vb023210 for ; Tue, 13 May 2025 04:28:48 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=qholBjkmu03 FdHRvMAFEHiCnlryUcq+WCE0WsE9Lw7w=; b=clTGICtSj2YYasarQEdnigsEtQN 1UT8M62U46N245c09+C/51ctES6Tg3128eZijR98FSW6063mS6gmg3vWCExn5jA1 HxHOEDjuuM+RpI73EOuZ5Jbkessxk/V197ZAxaaimVcSSnHcgRyVPrQjuPzEbc6d FkihbXrK7v4FwHkFrFBrJwSlDbJZMCA7v2qih512O8V318lh3vOp5OGriOtC3/vE OA4OJsaUAktMv4vKFFcfk2bGiNSAbWqRC/KU2vKKDWyWq25hA8DuWsA0L8PMsilp 36TYkTHCsHglJrnm037fNcxKru69Pz2enzw936vvkW3gl/WVLeYMHtsubyA== Received: from mail-pj1-f69.google.com (mail-pj1-f69.google.com [209.85.216.69]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 46kcfejwfs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 13 May 2025 04:28:48 +0000 (GMT) Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-30a29af28d1so4489620a91.0 for ; Mon, 12 May 2025 21:28:48 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747110526; x=1747715326; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=qholBjkmu03FdHRvMAFEHiCnlryUcq+WCE0WsE9Lw7w=; b=PyUazIYPsOSY33v7HfwNXK1PeIwHsFyWF88tFD0fvA7c3XEUItkITVjVyPBvC/cb72 hpBL5vTgEXVmTEFVlxgg87PPTBRqs7DuyzWbfXYjQml+HRp0CfBNquFQaDkd2IWdJp6M Rg6S8bFrqKddpfIc37sKe/rpF/aGcV8BI3xhy0tsf56U7pOKKrcGA0Z2GS2kijMyDFSP 0CFVd7udW/ulkZXNK9Ot+1wqwQRiO8oSseBGJEz6EgIdIm30buTb7aYAhhX/UZsxddMV ofNiZKSUr9EOdb8yHgyWMGDkQh4Cl8IM1z12MJumnUA2cqx8CIC71HoCp7lQqvtfyrBU YAFw== X-Forwarded-Encrypted: i=1; AJvYcCU7OdDOPOKmCliPAtEuH7lhiHvAsG7nHup8nUEwOg6R+OE0PHSyBkWKPhRW6aarBjhSevr2uoMg/lzKP7A=@vger.kernel.org X-Gm-Message-State: AOJu0YwH6qQyuvmWq8f0qsLUkDKghbz5MhreTWidQN0+jTBXq8VkmR8a xiVLBXCyd11wgFJ0O4PVFPhUxM8xGCpJvE/E4/d3pCUuq3T8XXO44xZTiYRWjal2LGdMFiumASy yT+EY35L79TelDxtrQ9jAbf7kAH8PLAWLUaWQbXFwKwnbG6blijiuOGIaQuNEnypEfZA2A50= X-Gm-Gg: ASbGncvq8JwbBvgmfxDg2+ugI0ke3VRdm/Y8q8cYErVNndbi3C8ToRS1FrVmaEqqzNC Z+Jgi0wf6w3+DE+ybTrUmCWkWkWPvk9D0kf4YPypMGB63Tw+cPmKQb0Iud3LFLkOT7MeL8jiVcn XivxEAwUMONnPPUkF03dobCqn3fgwLUclj0TQNnyMC2F3WrcqwEZHHT5OQEwKaP5j49wKU1iWaW Ly6EGOn7he5DOibE5LuqvoR+lYV6O2Jj0r0eW3Vt88NpzTPJb6H4pLSPFvjQ6/mWbI22EFMuQ9f 6Ly20k3kR6MgMqjtgJNOoJospebomwzlpsBUfRxxopmP X-Received: by 2002:a17:90b:4b4b:b0:308:6d7a:5d30 with SMTP id 98e67ed59e1d1-30c3d3e0a86mr27034337a91.18.1747110526294; Mon, 12 May 2025 21:28:46 -0700 (PDT) X-Google-Smtp-Source: AGHT+IF6dBAWDLUjqJ4kvsD4zVoy0B09Mb6RcQq2ArhYi6gGrcPHxd8tFxTtMMDWjf6AjNgGa2lz2Q== X-Received: by 2002:a17:90b:4b4b:b0:308:6d7a:5d30 with SMTP id 98e67ed59e1d1-30c3d3e0a86mr27034300a91.18.1747110525743; Mon, 12 May 2025 21:28:45 -0700 (PDT) Received: from hu-ekangupt-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b234ad3e9f1sm5486101a12.35.2025.05.12.21.28.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 21:28:45 -0700 (PDT) From: Ekansh Gupta To: srinivas.kandagatla@oss.qualcomm.com, linux-arm-msm@vger.kernel.org Cc: gregkh@linuxfoundation.org, quic_bkumar@quicinc.com, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, dri-devel@lists.freedesktop.org, arnd@arndb.de, stable@kernel.org Subject: [PATCH v1 5/5] misc: fastrpc: Add missing unmapping user-requested remote heap Date: Tue, 13 May 2025 09:58:25 +0530 Message-Id: <20250513042825.2147985-6-ekansh.gupta@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> References: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDAzOSBTYWx0ZWRfXwGWjbAPWOBQu oINtuAR4rtIsAQZ5BSUEO9odeEa22EXMhSUwi1aF5LRffgax4X0bznTc5yWABRDcnb4iMpZBTyt xdhuFHTfUg2vrLh4ztIoXjyj0yVS61FTRHVg9PcusRwm2vNIldFvgHottxaPUeM59WET0+cCS4A j6vaoAeyERaCJXWVholAl4ENIT/CcLSiMWem6aQ8ELZaydqf+82kvsK3Lz95hHHDKDvHaSYiZTk ABmwgi/0FqbdI3TcwvOnLX0o8Gy64eqU8tBQR5DaRBSUC25beI95FizXJZtpm6y95sk7BfOSdk+ YxrERtk5DJ81E28HqWaG0Xyc4JObINbPeR8L1BwfKCUYbCQkf2WoqGV8qjKgnmHKONFRsmbawll NwZKVwTGQweh/t1t4Fa5vsZwg1E4wbM7FZppmwncoJTLvs4PhAo7dgQS0hJKe/bNxDW9uWwe X-Proofpoint-ORIG-GUID: WEXIDMvjzAj6hTD4DHVXr1AlrIy1Cd0b X-Authority-Analysis: v=2.4 cv=asuyCTZV c=1 sm=1 tr=0 ts=6822ca80 cx=c_pps a=vVfyC5vLCtgYJKYeQD43oA==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=8BRqyYDQAlS27bmPn4kA:9 a=rl5im9kqc5Lf4LNbBjHf:22 X-Proofpoint-GUID: WEXIDMvjzAj6hTD4DHVXr1AlrIy1Cd0b X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 mlxscore=0 impostorscore=0 malwarescore=0 mlxlogscore=999 adultscore=0 phishscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 lowpriorityscore=0 spamscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130039 Content-Type: text/plain; charset="utf-8" User request for remote heap allocation is supported using ioctl interface but support for unmap is missing. This could result in memory leak issues. Add unmap user request support for remote heap. Fixes: 532ad70c6d449 ("misc: fastrpc: Add mmap request assigning for static= PD pool") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta --- drivers/misc/fastrpc.c | 62 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 51 insertions(+), 11 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index d54368bf8c5c..b64c5b9e07b5 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -197,6 +197,8 @@ struct fastrpc_buf { struct dma_buf *dmabuf; struct device *dev; void *virt; + /* Type of buffer */ + u32 flag; u64 phys; u64 size; /* Lock for dma buf attachments */ @@ -1867,8 +1869,26 @@ static int fastrpc_req_munmap_impl(struct fastrpc_us= er *fl, struct fastrpc_buf * err =3D fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc, &args[0]); if (!err) { - dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); + if (buf->flag =3D=3D ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) { + u64 src_perms =3D 0; + struct qcom_scm_vmperm dst_perms; + u32 i; + + for (i =3D 0; i < fl->cctx->vmcount; i++) + src_perms |=3D BIT(fl->cctx->vmperms[i].vmid); + + dst_perms.vmid =3D QCOM_SCM_VMID_HLOS; + dst_perms.perm =3D QCOM_SCM_PERM_RWX; + err =3D qcom_scm_assign_mem(buf->phys, (u64)buf->size, + &src_perms, &dst_perms, 1); + if (err) { + dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%ll= x err %d\n", + buf->phys, buf->size, err); + return err; + } + } fastrpc_buf_free(buf); + dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); } @@ -1882,6 +1902,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl= , char __user *argp) struct fastrpc_req_munmap req; struct device *dev =3D fl->sctx->dev; int err; + unsigned long flags; =20 if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1896,20 +1917,38 @@ static int fastrpc_req_munmap(struct fastrpc_user *= fl, char __user *argp) } spin_unlock(&fl->lock); =20 - if (!buf) { - dev_err(dev, "mmap\t\tpt 0x%09llx [len 0x%08llx] not in list\n", - req.vaddrout, req.size); - return -EINVAL; + if (buf) { + err =3D fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); + } + return err; } =20 - err =3D fastrpc_req_munmap_impl(fl, buf); - if (err) { - spin_lock(&fl->lock); - list_add_tail(&buf->node, &fl->mmaps); - spin_unlock(&fl->lock); + spin_lock_irqsave(&fl->cctx->lock, flags); + list_for_each_entry_safe(iter, b, &fl->cctx->rhmaps, node) { + if (iter->raddr =3D=3D req.vaddrout && iter->size =3D=3D req.size) { + list_del(&iter->node); + buf =3D iter; + break; + } } + spin_unlock_irqrestore(&fl->cctx->lock, flags); + if (buf) { + err =3D fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock_irqsave(&fl->cctx->lock, flags); + list_add_tail(&buf->node, &fl->cctx->rhmaps); + spin_unlock_irqrestore(&fl->cctx->lock, flags); + } + return err; + } + dev_err(dev, "mmap\t\tpt 0x%09llx [len 0x%08llx] not in list\n", + req.vaddrout, req.size); =20 - return err; + return -EINVAL; } =20 static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) @@ -1977,6 +2016,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, = char __user *argp) =20 /* update the buffer to be able to deallocate the memory on the DSP */ buf->raddr =3D (uintptr_t) rsp_msg.vaddr; + buf->flag =3D req.flags; =20 /* let the client know the address to use */ req.vaddrout =3D rsp_msg.vaddr; --=20 2.34.1