From nobody Mon Feb 9 13:36:33 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 276B8331209 for ; Thu, 15 Jan 2026 08:29:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768465779; cv=none; b=RUz4zyMLxXu1e9WcnMP5gD4WDMgXR7eA6sCj6/WSuoGyfpbhtnAot45ZeYpB2h/2tfpDyAtz2av21pa8icHmlAzs8LU2X8zXN1FK7slm9FDZSubmBA480SU85fULMDndKtBRHdH3mbtqW8/svhEjKmCFdMal4DvLqivwZ6zzpXw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768465779; c=relaxed/simple; bh=b73oRmsUcCEr+kAZMeuVAMxNJUAgmIX9NK3DcBwLVN4=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=EuRucwKJqvOghVyNs9FC/lCdFRczx29FqpFbF6QFd8mliGnSVXjexi/O8lmvVjslTy63WoqhH5CdvWqY6pMSeb6FyP4jqGz68NZ1wTMyT9KU+w/D16xoT6wPbvY7/TGMLYV3AvRRlhVmjw6IMrA7Q/UYDthtK2v9SjPSSwzP6So= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=afbY9jeP; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=Y6BBlPgz; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="afbY9jeP"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="Y6BBlPgz" Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 60F6fl971850921 for ; Thu, 15 Jan 2026 08:29:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=gXRRzI8PFSG Xkse4fblghbMDCYBL2rAyR0rE6A7MHy0=; b=afbY9jePQLJ4T8Riy9B6Fz6uBKl 9aJtbGD5R+Gx9wsLEotDYHrdQMhqjlLFvk4XxvKxmQfEk+3NMteHJ6ko3XKi33dU lCeHLZxtfJW174Eg/bmF6gmbYTqfDmPd2TyQdFSEmTnrQDLcEBbDvtDzDAPbU9Td geTNliMi5lgOILPcKXmLRY+hr+XwvjrgNQ3+btaVxCuhoobC1GHYw33JaSX0QRjL A//cpllfpTxDz+x8qe5RqiJdWLPw6iNNNerk946RMqEt0axc7oobAcdZ+6z/aQSD gVFy6qjEjT5WYR0sIy8U3MU8JxV3e0v7Rxyu1+6EEsZh76tcHT0Kh2Z5WyA== Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4bprej0q03-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 15 Jan 2026 08:29:31 +0000 (GMT) Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-81e9d0c656fso1419063b3a.0 for ; Thu, 15 Jan 2026 00:29:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1768465771; x=1769070571; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=gXRRzI8PFSGXkse4fblghbMDCYBL2rAyR0rE6A7MHy0=; b=Y6BBlPgzJIoJuXD/RKAL/P/GTWK6MGxq6MDEH2mvKPLWi1x/qBlNtOYfEi8vYwWYmx 03c0yDBJL7rJNVoGxj3gwsuPxhnar1fjEtpKihCWN8hyDwYPcNUGWwMYh8bJ4CRpqXv7 K2Wldw6lljizuhkK0QDrYnaeDnJU5QpeGny7ShJm77MmD6RC+2njsaQyKBFM23fUeNtr aJoxb6iZ0xXClYWkeuDGMJFgyF7jlF/aS5l2m2Ik5YMHxZ3pYfNWW5MbSislclkFA5zi KrBzo1RVREpWFh2XwzF03+Qph+1UWVMtIoWhf1jEuI0Ds483VJZkfEZXVFltXb3e1R4S 87QQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768465771; x=1769070571; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=gXRRzI8PFSGXkse4fblghbMDCYBL2rAyR0rE6A7MHy0=; b=Xf0wjN5kILOcMubrb/Yb5XVR535zIzpC+cTPSnto2jRg1FiJrMC6ntsebiXoO91v1h gpigW9IsfMtLEU4gbqciDQfehBlhaFb4li+191G+N9f/yGLaEy2a2Y+dEpugbsaapc+L oamQLNZ4A+YvwTnCvooFDUH/id3ZITKQkkBa7R0m7INtj1/7e3xkTelqSUC5u3r0faUW JZTsVvKXdMAoN7tpPiAlI/VLrgGyIAIXST9Xdds0fJFkjR3N79UP6R3WzHRoBN5SlXE1 sS/OGOZwah0WvPm7TQfANWBkwMk2V62ikW9eu52R5khnwFbz5bfir+Hf+xU/HgLn2nDS daUA== X-Forwarded-Encrypted: i=1; AJvYcCW+odCrb8of0nNkyGSaI82c43ajsbR53pp6Q7YspMbxDoPDl47rOKj+ufi4NcRbMJ2AngYN7UPE6KA/tVQ=@vger.kernel.org X-Gm-Message-State: AOJu0YxZOO4LYveuR/aNSrQxN/KIEQ52w5waNZUeYSk0ETHo1O2EGNFi LbPBbh6glPZfxNgrZ9w7H4e+Vow6ir37d6SWlRUNh6xI/cvFUgdlrrzxdAKehK5yd0KOS6W4WuW PtZJzYW0alNUkCVMSy3FqIdRV13pghY6drlFSlkS0eG9ZAc9m+IZfbypePK9XfY6EQcw= X-Gm-Gg: AY/fxX5JBsmOgjcHyscEMTIhWZ5ado3kXPEVQn8wDbyjoqYUB11JbZPVtb+jIqUjtY6 IFZkUZO8NC8uHxBF/wqv4VhUK3YQNQpp5s/tO6Q/s+Nn779LdrmSOWs3m62aCiGMvVkZKj3oIUP gbX5fOVZCZ/B26XTkxd2ofYS6wZPz16PvCUKpd+PQeCXLGRxjyHil3bk7bnEd8zl4N+e8tfvkNG OPGjTeIr8LxLntPcV92z+IXnmdaGYajKk0AxSF9LQ4A7a9A89yIyticdUGhSRro1wqjz8kEbMLY Fn6MWFMc+1p0rDABRlnWvj+Kbt58Ki/Kib/pHNT+ydx700rMzuFou5LnmPFy+klow0f5ufCXpxU Pj1fIHTup0c9RW6g+gzkXOYG/7AE8GzcN6Xg5uwCw X-Received: by 2002:a05:6a00:349a:b0:81e:c91c:70c5 with SMTP id d2e1a72fcca58-81f83cc6427mr4776803b3a.29.1768465771059; Thu, 15 Jan 2026 00:29:31 -0800 (PST) X-Received: by 2002:a05:6a00:349a:b0:81e:c91c:70c5 with SMTP id d2e1a72fcca58-81f83cc6427mr4776785b3a.29.1768465770602; Thu, 15 Jan 2026 00:29:30 -0800 (PST) Received: from QCOM-SocCW5bzXR.qualcomm.com ([202.46.23.19]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-81f8e69d1e7sm1773296b3a.58.2026.01.15.00.29.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Jan 2026 00:29:30 -0800 (PST) From: Jianping Li To: srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org, linux-arm-msm@vger.kernel.org Cc: Ekansh Gupta , thierry.escande@linaro.org, abelvesa@kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org, Jianping Li Subject: [PATCH v2 1/4] misc: fastrpc: Add NULL check to fastrpc_buf_free to prevent crash Date: Thu, 15 Jan 2026 16:28:48 +0800 Message-Id: <20260115082851.570-2-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260115082851.570-1-jianping.li@oss.qualcomm.com> References: <20260115082851.570-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMTE1MDA1NyBTYWx0ZWRfXz43hPPovj2BK gbsMhW6/TJvmpcVguJ/BGTuoQWMt4ISyLPe6Uu4IGQicgLcODEqkMGyF9r5wRUDGIsp0/+tGJUd s4HEOLn2VN3Ppk4Waty55RbG1ulMtXO0gkDfaKCycOWiDOAQnHKWX1tqVjOMbczTGABEC4UzWyE 3Jm95wPTxlzutizFIzOu6kb5F052t8RqYIefV3tRxwvoMwV9/Ao6SH63CFbkRO21k7e0e4S5epq DNPh3iDnq/vKvD/vRd1QaVYOvQczcT/3juItHWv1HlV0MZaRBiEriYRg+6GOAesZ/87qMwERTtl 3nh+4aELYN3v+xpIasHqvkfRGHJoRnUsGOmmmh5tgv4EZ01WRTyYQ+h4QpBIXeYAzeTGNeyYrnh 4u8CLBg6Ovyq5EV0+q8jAR7d8On43UmkQi/1xM1Ddi1f7zocky9o1G5NwWaaSfQM8qUXYWYRkYe 0zItr0fGFyJH8m8skiQ== X-Proofpoint-ORIG-GUID: lB5LzA-Uqzm-6yToTbEPWfgGfcDttPrA X-Authority-Analysis: v=2.4 cv=Rc+dyltv c=1 sm=1 tr=0 ts=6968a56b cx=c_pps a=rEQLjTOiSrHUhVqRoksmgQ==:117 a=j4ogTh8yFefVWWEFDRgCtg==:17 a=vUbySO9Y5rIA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=ZnmZ8TzD_GdZzTgawW0A:9 a=2VI0MkxyNR6bbpdq8BZq:22 X-Proofpoint-GUID: lB5LzA-Uqzm-6yToTbEPWfgGfcDttPrA X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2026-01-15_02,2026-01-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 adultscore=0 spamscore=0 suspectscore=0 priorityscore=1501 clxscore=1011 bulkscore=0 malwarescore=0 phishscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2512120000 definitions=main-2601150057 Content-Type: text/plain; charset="utf-8" From: Ekansh Gupta The fastrpc_buf_free function currently does not handle the case where the input buffer pointer (buf) is NULL. This can lead to a null pointer dereference, causing a crash or undefined behavior when the function attempts to access members of the buf structure. Add a NULL check to ensure safe handling of NULL pointers and prevent potential crashes. Fixes: c68cfb718c8f9 ("misc: fastrpc: Add support for context Invoke method= ") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 4f5a79c50f58..515a43c9d95d 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -414,6 +414,9 @@ static int fastrpc_map_lookup(struct fastrpc_user *fl, = int fd, =20 static void fastrpc_buf_free(struct fastrpc_buf *buf) { + if (!buf) + return; + dma_free_coherent(buf->dev, buf->size, buf->virt, fastrpc_ipa_to_dma_addr(buf->fl->cctx, buf->dma_addr)); kfree(buf); @@ -510,8 +513,7 @@ static void fastrpc_context_free(struct kref *ref) for (i =3D 0; i < ctx->nbufs; i++) fastrpc_map_put(ctx->maps[i]); =20 - if (ctx->buf) - fastrpc_buf_free(ctx->buf); + fastrpc_buf_free(ctx->buf); =20 spin_lock_irqsave(&cctx->lock, flags); idr_remove(&cctx->ctx_idr, ctx->ctxid >> 4); @@ -1591,8 +1593,7 @@ static int fastrpc_device_release(struct inode *inode= , struct file *file) list_del(&fl->user); spin_unlock_irqrestore(&cctx->lock, flags); =20 - if (fl->init_mem) - fastrpc_buf_free(fl->init_mem); + fastrpc_buf_free(fl->init_mem); =20 list_for_each_entry_safe(ctx, n, &fl->pending, node) { list_del(&ctx->node); @@ -2492,8 +2493,7 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device = *rpdev) list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node) list_del(&buf->node); =20 - if (cctx->remote_heap) - fastrpc_buf_free(cctx->remote_heap); + fastrpc_buf_free(cctx->remote_heap); =20 of_platform_depopulate(&rpdev->dev); =20 --=20 2.43.0 From nobody Mon Feb 9 13:36:33 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AE3E933506A for ; Thu, 15 Jan 2026 08:29:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768465792; cv=none; b=d1cE9k4tKrt0RxLt6aoTkGtwfQb3ctKVMQj6rBBOglKnPiJB1k6VyJC7r90QlVpGQg69W56M0+ccySOjr7Ueh5g1+HjXazR9TS/P+epMP+U6U7VjKdj7OKJZuITPg1S/YDXd+BO29Tu4aqkM2SksGaWHBNZDht96hAerqRqvM0Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768465792; c=relaxed/simple; bh=kFYArw6kA3ak0O+0DSJcTc6oRpn6IstRIU9gS8rLTCc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=r4ku35hzjq7HGQrxtZWP3rAaUwbKGK7mYcuhSKyaHWSFRq3H0JSMv/gLkgrvqVMmBQvnezJ0HxOErHCnAI1LsRvhoXJEEisyG3ok5VeEF4kX3yqLmXiK3vacihvZXns3k54E020OlrEa0j+qYbkjmnYSP15m24mHAGNaeZgmzDo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=Q7K9OY9L; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=Kly9Irkp; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="Q7K9OY9L"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="Kly9Irkp" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 60F6fh9H1581843 for ; Thu, 15 Jan 2026 08:29:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=gjM0kaavbOL Ce1K3pLI5wzYI8dV9tn4xiVQbvJTgorA=; b=Q7K9OY9LXLBfPW2UdgGJqwWByaT tUOaOgB+54qFJ3fnanp5m8+lSTn+zP31zBW18qwyb57/vmUheE3sQr+0N413IEti F15QCJ210ELt5ug3bt1u00kkMhcB4Ija5l9N74t0Vr+FcNngJYwCVCYWXVO3DFdF yq+cJg4aXA8GP16cvGZtR200bJlodB98ZwWreYjqqSDJWMvzC2Y0ZgcjAmdOYvAN m1LzFj7X26khhLhMNzvqlZe/VLzkwOPeVZP1gSbmGW7N8HuqY/1eFJzMQa/LcM8c r2uQWqqrlkeTwsq1aOrzKqOEw24X2orFJUF91PebyfjnGP+7w8GboHuFe6g== Received: from mail-pg1-f199.google.com (mail-pg1-f199.google.com [209.85.215.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4bpj1pst3m-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 15 Jan 2026 08:29:41 +0000 (GMT) Received: by mail-pg1-f199.google.com with SMTP id 41be03b00d2f7-c552d1f9eafso1224282a12.0 for ; Thu, 15 Jan 2026 00:29:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1768465781; x=1769070581; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=gjM0kaavbOLCe1K3pLI5wzYI8dV9tn4xiVQbvJTgorA=; b=Kly9Irkpd38nu+1kFNyzMhD+aW3zyG16ewIpVyQ9eQWmkchnjsJvI4YFtRAaipNGr0 Zq2uRH/IKx2xlhagnExv6wNAz56nJdmgyROVQaEH/YkMdh0nD1cBHtVE/yhGfmdRrbh8 /ryl5l+PHwMrtvDqOPyVg40Y+TaCCB6ZfVidxWae33i3qomEuM5SX26VsfZ31U05n0tb n/kUqBcD/XaBrdGr7KoCHGx3LiMZ1mb6/O9I9FL5N+ODLscpoS5qA+TQEvaeLFMjwBxa hV5eVO7Hox2KnSHGSZW3CJocdr0C+OwFtaGTKwD82Yo1pMO4WMKOKAm5TT1g5yD3xqpK voUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768465781; x=1769070581; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=gjM0kaavbOLCe1K3pLI5wzYI8dV9tn4xiVQbvJTgorA=; b=U5m0xe3NR59WyGOpOhGLe8lrquzONL/c27R7SknL7HUKkYexKF74u0fJfdU/bgRIQv 5jRybDHVvmkBwRxmT9lCVcr/HT15JTUqDMKYoF5Y2OPWMjJ9rhyaLN4kPTwt+lpSTYOQ 4BMoys5fYco2lNEAUMafL2z+osptQtO5Bms6CnbJNsNQCaKmy1TJU/Mioj5OKQWXr1ll KfsGeTKy0qvJdbhFBcHJP4Fvn2SIi3jlEF97IFV56k1HL09NT4rY90wThm6iLjuYoUtt Gkgn09j+yT5L+LYQvDuIH+vG8wqY6KikdyKcp/hK//IBxFkZ/Hm3BuBjyFhqjuZTappF w2WQ== X-Forwarded-Encrypted: i=1; AJvYcCUqvNVQiS95yjmiVzx7XvBqIoMgKRqlxAF4B6z32dIBL7RkqMxn8sjkpY9UPUZg67Hxoh77IC1kVcjH2BA=@vger.kernel.org X-Gm-Message-State: AOJu0YzceRHhF+of7a9fMd1+JIq+/dDw24JAtLczQi37gMV4X5y8ElB6 CbKLCv9k6rgCUlqiYBPdk1UJZYEUfIji6yB4apmKxTWimVRRTrBZaHm68XJv+XcX4iPcZ0SyPMQ SW3BZYKfNRRdmKb+Vz67D65p2lkmqylSTCINlD8wxC3+lP9/4Lb/y154JcmGnKB3vLLg= X-Gm-Gg: AY/fxX5UxCpzVitQZIan6V7MI9SkIM2sUtG3l2Tr4Il1AU43/xlxyK833UGhmISk37M EfZ8DGqLtXsaCbkofnDQ6XtwY90J1uIbv10Ci6i4Cp+j1shMWV0OJdbjMcrzEwxHKLB+NCARAjt ziFbHj1WLn3HjB7DstIyjgXlbKsy6Em097SBVnUUyKy6CIp6vcTQcWAJlWq9YKGIAd1p8e2usQB Ed+LIHAHQjjA8Uu+uoOu8PBGNy+BhfzHJ9k74I8gqOhFwWJH4Qw7VWN682wRNhM+Ve48/w+mpP/ dnrDwfGvfmqeuU2lFU4ZySLEgpEf0vyfNryXsfULT9c9R/V/pcWqpqJv8JUhG2piuOtwv3ST4g2 4TYnCDKznZxxcrL+GcBV+ygwvR0kyac4qgj5TcyYU X-Received: by 2002:a05:6a00:1d0a:b0:81f:1610:709a with SMTP id d2e1a72fcca58-81f81ce46f9mr4520958b3a.5.1768465780917; Thu, 15 Jan 2026 00:29:40 -0800 (PST) X-Received: by 2002:a05:6a00:1d0a:b0:81f:1610:709a with SMTP id d2e1a72fcca58-81f81ce46f9mr4520930b3a.5.1768465780354; Thu, 15 Jan 2026 00:29:40 -0800 (PST) Received: from QCOM-SocCW5bzXR.qualcomm.com ([202.46.23.19]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-81f8e69d1e7sm1773296b3a.58.2026.01.15.00.29.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Jan 2026 00:29:40 -0800 (PST) From: Jianping Li To: srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org, linux-arm-msm@vger.kernel.org Cc: Ekansh Gupta , thierry.escande@linaro.org, abelvesa@kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org, Jianping Li Subject: [PATCH v2 2/4] misc: fastrpc: Fix initial memory allocation for Audio PD memory pool Date: Thu, 15 Jan 2026 16:28:49 +0800 Message-Id: <20260115082851.570-3-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260115082851.570-1-jianping.li@oss.qualcomm.com> References: <20260115082851.570-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMTE1MDA1NyBTYWx0ZWRfXxO1cbmPZ1fAW AbzeztimOovPdzIzQMxJgFyRVfpSnG+oJH1GGop0Fz5MEY8HlS3DVNpoIZePSMTPQQr00TysrJN cAujiW+CnZCCsLmnvAo3gmu9reyCke9bvjHeMatHdexmUrWYeMxxoQjODH51LGLgosCX+mzjdi2 M3gH1bNucVfRKO/vRPFybxdlhnkS8gU5ZSVZJ33ioO2kjd63hJJNCuAWbzBQEkiVPfVJd08i9AC k0ycOTi5XIzmtkxq5tdbd30DXTJec+gn09X22DsGrZGW7Mz9smrrKE9JYrGDrQ0rHjmqxixVJuf OTWWW/C9jrOFLv0rYWZix/7bozI7ipbWlJsm7CfUnL7YQCWNIwoGuS+l9x0LMq9DCDCu7sqI+6f dl6c6r4Kq1Km8WCr7KlYzFyPdFSCdAuvQIGeblkMVuFXSkW0pk0Q5L86wzRMzGEbBtMDXfJh0uP NO0WL/eMQ7vctxD70eA== X-Authority-Analysis: v=2.4 cv=J+KnLQnS c=1 sm=1 tr=0 ts=6968a575 cx=c_pps a=Oh5Dbbf/trHjhBongsHeRQ==:117 a=j4ogTh8yFefVWWEFDRgCtg==:17 a=vUbySO9Y5rIA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=Op9FgWJ_R3wbKKMAuNAA:9 a=_Vgx9l1VpLgwpw_dHYaR:22 X-Proofpoint-GUID: KofFLAZi9RTW6v8vuxWa9vJnPSqe1a1F X-Proofpoint-ORIG-GUID: KofFLAZi9RTW6v8vuxWa9vJnPSqe1a1F X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2026-01-15_02,2026-01-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 adultscore=0 priorityscore=1501 bulkscore=0 phishscore=0 clxscore=1015 suspectscore=0 malwarescore=0 lowpriorityscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2512120000 definitions=main-2601150057 Content-Type: text/plain; charset="utf-8" From: Ekansh Gupta The initially allocated memory is not properly included in the pool, leading to potential issues with memory management. The issue is actually a memory leak because the initial memory is never used by Audio PD. It will immediately make a remote heap request as no memory is added to the pool initially. Set the number of pages to one to ensure that the initially allocated memory is correctly added to the Audio PD memory pool. Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 515a43c9d95d..4f12fa5a05aa 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1328,7 +1328,9 @@ static int fastrpc_init_create_static_process(struct = fastrpc_user *fl, err =3D PTR_ERR(name); goto err; } - + inbuf.client_id =3D fl->client_id; + inbuf.namelen =3D init.namelen; + inbuf.pageslen =3D 0; if (!fl->cctx->remote_heap) { err =3D fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, &fl->cctx->remote_heap); @@ -1351,12 +1353,10 @@ static int fastrpc_init_create_static_process(struc= t fastrpc_user *fl, goto err_map; } scm_done =3D true; + inbuf.pageslen =3D 1; } } =20 - inbuf.client_id =3D fl->client_id; - inbuf.namelen =3D init.namelen; - inbuf.pageslen =3D 0; fl->pd =3D USER_PD; =20 args[0].ptr =3D (u64)(uintptr_t)&inbuf; --=20 2.43.0 From nobody Mon Feb 9 13:36:33 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D8408333720 for ; Thu, 15 Jan 2026 08:29:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768465800; cv=none; b=izkUdutabkrVnJ+qI8QgWlKhzMJwGPdo78/6rpNjW/RfSvsgShkm6A7JBQFQBv/faej19DRyQHwqFDGMkgpivrjGNQaufB2pDHPgN9vNgMBFP2gqeJPlPHtTT29oIIssVIXmEaLJ5MFBUE8OfcMdTJMH1Fc871Gj5ibeJyXmoG8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768465800; c=relaxed/simple; bh=VCRsiSWmBZTWoniAiDuhukrpl8fYTCpGwB7tOHtDVsw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=kUEWuU7ihxeuprptw3APzQVn1m1UKhoRo6zIDYFDDFNoeaB84YmMrHtvWoSxg0TBJc68R2YLQq4C6gnkwm3Ox3oEE3/XG9+mIx2NLFwJVtyUKiDJPx6D6XsdSIia9eEH/QJQtOXwaw0qPwC5bXXh9ChLWINjnBUOd5M2bbrouOQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=JpRj1lqI; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=TtnialaF; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="JpRj1lqI"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="TtnialaF" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 60F6frOZ1582040 for ; Thu, 15 Jan 2026 08:29:52 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=12vcQeB7vtt +410hwakfDxk9ykcl1qmLQ2Bo+92glU4=; b=JpRj1lqImLTb4jPLxwNJf6PGwh+ R4DUfocyLZEugvuOkB9EttRFJvUCYqsqhfw84CC+fe/wvO17O5fSntJhciOAXXpD 5I4K2vtUhakIWW3QdOucZ3xa2/t+4iw7vMwVY2sBAfjreskxNR0cnK/k3pHIIqWl BU5P0F76cbLedbqdUOhcvfcPI5Rh3+k5eLWTl0XmDPcEcvvENxkqXOyv3anq0G2r PBBlfYE0ecdYzyA3E5lWk8uyer3FQHzQYXmKsTdg/xStnbrfmlj8MnO99HGDWaXj 4WhHVjSyfOFbiMvjfoZw5Oz+/glZgAA4gYDrFie3Jbbta6hWxxgbbNAVqwQ== Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4bpj1pst4d-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 15 Jan 2026 08:29:52 +0000 (GMT) Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-81f53295ac2so1459055b3a.0 for ; Thu, 15 Jan 2026 00:29:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1768465792; x=1769070592; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=12vcQeB7vtt+410hwakfDxk9ykcl1qmLQ2Bo+92glU4=; b=TtnialaF6JLmw5+hO2bRwz26D9KPnjd476tuW4hZUVVXSMb2tgsJh245ZbNp5/PG7Q l6E+2O5SdmfB5Dsahe4CFSKZOq2fYXKNh48XiR6oVyCXSCpfVhXk3zgrJroEFAwEPRzv dDmew1wnHUx/LHtWSD0ZyFUBc/iEMiHphrzOlNYbF3USNmwlb7P2HdY8ZpVWdI/qSVP7 5UMxMt0HfURm0Ru/EPsyQkDQ8ajJXsjxS9pmldEqwYV4QrUrqC+558q1uzvOHCjsmDtr FOt678WOTBHM1ZENkgrx4oSAxN33um/4+o5FH87fDbiuZ6udaxZ6uh52et9tQm6SBCAr Bt3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768465792; x=1769070592; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=12vcQeB7vtt+410hwakfDxk9ykcl1qmLQ2Bo+92glU4=; b=sZAZJyRI+0WvxwHWYrhGGxktgwxnc7e9E+4iIZ39ZxSrB0yfs3qGudWyC9ocWCBqfP 0kXsG0/930r6zyQiVIw8dLIvv3Iy9AYBZ1uYJBgu7OnOk1nwa5IeT/LpJg3q5zNHaxHU 5dVebtblxMFStn9IqqFSScWjy1ujVKk6VXL3dDWb9opu4TYKFvRyr0HBLSRXBxpODTep hHN3idoyDpreWlGgr3O+zqjdaAOw1AX0ASPTRq4voA2lxov/RZDvCVFXo9O1/9B4fxGs e3fnm32oq8sRNgHRegRiccrjYpOBv+WPBdRE7VREUmolKXzQ5LO+Z5gRGbj+X9nNKyYz koVw== X-Forwarded-Encrypted: i=1; AJvYcCWf0QLCSf3xeE5F7MGjhe2tZVOcTnylSW7BRVT8P8lv+FXn/CM3yLExf4cC0lcTFLI8NnZNmi/YWAn4wBE=@vger.kernel.org X-Gm-Message-State: AOJu0YyGCzgAJPf4h3O8OW9C5u0WRl3sLLY3YWtdlJWaS30gU0Ayo7B9 HOmHVTpv0kHlD7qdybdSTIiariR0pdm+B7sh4p9JmntOfVeCsvkk7S1sJLPf2aqReBkWYpEBTOt kyWitglej50RL5l2sC27zvQxYCFcBNkDwQcs8XoNtkxNQBcOx3LOsEtRBnlTrTVFMQHE= X-Gm-Gg: AY/fxX57wNkrtTn63PDNkK/haU/JXxbRC9Gr8rikW/wHFn/FMjgYdMm4XZPjmUDhEFa Qjn4x22zRIieuE6ApDz5NHgYdvnUp/K07YwyXbfLkIboolxqvnkDcB+RXfxkKGkzczEyMbFpEfs 4qBHMjZxhzBM66E1ONQ6zhKi/3ADvp1reBf0PGFTbQdciXoEMYVhLAQwbjim+Td4dR8Z05/griq ILbsMJq80ye8bB533yRIewMUrGlH/i8HJh0TkgFNxo3LeVI1yG6fdf8vnnlOyrPX51J9m9ASwAw vTnkm7K0HvG+2GSNPTZd5kUPd+paYmDenpdyevgge5SwZc7dyMmbdR21PGfnrLpRbaQxl9Dk21z 3+m70O5rnGCaOii+vm4RIW3sTTTOfjP/kqPzWCqfH X-Received: by 2002:a05:6a00:ac03:b0:81f:5acb:55e7 with SMTP id d2e1a72fcca58-81f81fe0a08mr5626386b3a.54.1768465791732; Thu, 15 Jan 2026 00:29:51 -0800 (PST) X-Received: by 2002:a05:6a00:ac03:b0:81f:5acb:55e7 with SMTP id d2e1a72fcca58-81f81fe0a08mr5626370b3a.54.1768465791237; Thu, 15 Jan 2026 00:29:51 -0800 (PST) Received: from QCOM-SocCW5bzXR.qualcomm.com ([202.46.23.19]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-81f8e69d1e7sm1773296b3a.58.2026.01.15.00.29.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Jan 2026 00:29:50 -0800 (PST) From: Jianping Li To: srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org, linux-arm-msm@vger.kernel.org Cc: Ekansh Gupta , thierry.escande@linaro.org, abelvesa@kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org, Jianping Li Subject: [PATCH v2 3/4] misc: fastrpc: Remove buffer from list prior to unmap operation Date: Thu, 15 Jan 2026 16:28:50 +0800 Message-Id: <20260115082851.570-4-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260115082851.570-1-jianping.li@oss.qualcomm.com> References: <20260115082851.570-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMTE1MDA1NyBTYWx0ZWRfX0mxJ5GzK1S1H wFS60fu0C33V0J03OVvVefYPCY2Z54W/BpAifw6Z8KCB8CBhsu2R5k9LiuuGpEuE5TTUYjOtb/I 5PbQTVniOhR2750pntdj88QpPpRDANWm3M9WFljSKqR9sm8X/rdCRaPmV5009nsiw8DlWmAuJ6D K6YxkbQARAhfojc1Sk7NQpQSY7nD1PMmwrzeC439kJ7Os8ZB+2pIhEpFtFRRTwPoWy31WLYvORN JURHGRHEoGO/BS+Th5PBMNWiBTG5oz54JhlJ8N5eWQ8SwunRvMHSwExssYaHMWKziWR5CfBsjU7 726pYgpEOMm7IWowAGtOUZtFCISBMemw4ddaOMazVvzm6oWPtAZ9bcdEbdlHHwOg7JrKyEz2N4/ 4LLxhKeZHv1nXWODIaYJ0Ew5X8fj/l//l/EPTjJ9kxtuWBZ/bcCUUCm0DWxWVGA/njUW9kxuL8g aWRZjLD1NPG3HbJFltA== X-Authority-Analysis: v=2.4 cv=J+KnLQnS c=1 sm=1 tr=0 ts=6968a580 cx=c_pps a=WW5sKcV1LcKqjgzy2JUPuA==:117 a=j4ogTh8yFefVWWEFDRgCtg==:17 a=vUbySO9Y5rIA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=65MDuzgJ9_6jycvYPFoA:9 a=OpyuDcXvxspvyRM73sMx:22 X-Proofpoint-GUID: nsVyk6YFP_wJcJdb9onSRLAayffZ-YEh X-Proofpoint-ORIG-GUID: nsVyk6YFP_wJcJdb9onSRLAayffZ-YEh X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2026-01-15_02,2026-01-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 adultscore=0 priorityscore=1501 bulkscore=0 phishscore=0 clxscore=1015 suspectscore=0 malwarescore=0 lowpriorityscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2512120000 definitions=main-2601150057 Content-Type: text/plain; charset="utf-8" From: Ekansh Gupta fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if any other thread removes the entry from list while unmap operation is ongoing. Remove the entry before calling unmap operation. Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 4f12fa5a05aa..833c265add5e 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -202,6 +202,8 @@ struct fastrpc_buf { /* mmap support */ struct list_head node; /* list of user requested mmaps */ uintptr_t raddr; + /* Lock for buf->node */ + spinlock_t *list_lock; }; =20 struct fastrpc_dma_buf_attachment { @@ -441,6 +443,7 @@ static int __fastrpc_buf_alloc(struct fastrpc_user *fl,= struct device *dev, buf->size =3D size; buf->dev =3D dev; buf->raddr =3D 0; + buf->list_lock =3D &fl->lock; =20 buf->virt =3D dma_alloc_coherent(dev, buf->size, &buf->dma_addr, GFP_KERNEL); @@ -1865,9 +1868,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_use= r *fl, struct fastrpc_buf * &args[0]); if (!err) { dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); - spin_lock(&fl->lock); - list_del(&buf->node); - spin_unlock(&fl->lock); fastrpc_buf_free(buf); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); @@ -1881,6 +1881,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl= , char __user *argp) struct fastrpc_buf *buf =3D NULL, *iter, *b; struct fastrpc_req_munmap req; struct device *dev =3D fl->sctx->dev; + int err; =20 if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1888,6 +1889,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl= , char __user *argp) spin_lock(&fl->lock); list_for_each_entry_safe(iter, b, &fl->mmaps, node) { if ((iter->raddr =3D=3D req.vaddrout) && (iter->size =3D=3D req.size)) { + list_del(&iter->node); buf =3D iter; break; } @@ -1900,7 +1902,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *f= l, char __user *argp) return -EINVAL; } =20 - return fastrpc_req_munmap_impl(fl, buf); + err =3D fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(buf->list_lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(buf->list_lock); + } + + return err; } =20 static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) @@ -1985,20 +1994,23 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl= , char __user *argp) } } =20 - spin_lock(&fl->lock); + spin_lock(buf->list_lock); list_add_tail(&buf->node, &fl->mmaps); - spin_unlock(&fl->lock); + spin_unlock(buf->list_lock); =20 if (copy_to_user((void __user *)argp, &req, sizeof(req))) { err =3D -EFAULT; - goto err_assign; + goto err_copy; } =20 dev_dbg(dev, "mmap\t\tpt 0x%09lx OK [len 0x%08llx]\n", buf->raddr, buf->size); =20 return 0; - +err_copy: + spin_lock(buf->list_lock); + list_del(&buf->node); + spin_unlock(buf->list_lock); err_assign: fastrpc_req_munmap_impl(fl, buf); =20 --=20 2.43.0 From nobody Mon Feb 9 13:36:33 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30569331A40 for ; Thu, 15 Jan 2026 08:30:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768465816; cv=none; b=e83vRb4COnlv9H8905WLpt35Y2YFMFDUgSOx/r86dpLXW59hOlmL7VDK2UkTnO6kdlkF+dlWA6fO2yhabNRsxvokvvWrqhpKY/RUn39la5o374XlV0UlRCFldvQvP01MxsJz1XWYlCS+vBVkwJPKTxUfPePSJB4crBsCZvSTpLI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768465816; c=relaxed/simple; bh=Bt0PcQMneI4KUYJQ68wmmXPifSyAdfuywiTPH2bnP5A=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=R/IeUkBRiTjzUbhWuZcmKI0U6x6rVsNG3mBkJluaKerof55Q5dh5r8fictyeIabK+7jL+Kb3F11+0LpeBsJhCHzJ9ENhkLhzezbYaxhRnDEXiDDNoGKb4xKE8ycOjD053se4BAJoK+EGLZIOeaJtRyWBMPCNRiHEktnLviDi6hg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=hVI2nRWj; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=C9zy3G2/; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="hVI2nRWj"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="C9zy3G2/" Received: from pps.filterd (m0279873.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 60F6fuRl606569 for ; Thu, 15 Jan 2026 08:30:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=yRAomd5/Wnd mqPt4/KPViCWMZ2kB08fk6+zB+UfeCDE=; b=hVI2nRWjdZSESpYczFwIsLzy9Qx 9zLckqHcW7nRODwuOh/IXba5OqmhGd8vK/Il79OqwH5h4SBnIIsqIfXkQhMFsklf 2r7jlfcfE28LtJ6/BqmMNgewkFN/X5vfpnNgFv9ieIUTLhZXD7Z24uBsbGFqUw6+ sPEqt3PYLxMrIX7c+PMvsD0nuvvbgk4dDKlhZUH9eLRIzi3ElqOobEwANmFLO0CV m1aMNf4UZ313uVOSOxvCxK+WFCTAjSXJBPpg1SyjD+gEYAMLpMQ0SIUIQQAT8vDH HkwoZ59SuYO7u2Wm42SUTNZ74rm+DSi3gQTUZ2D0+CMYYnFdWzw8ZJpe1MA== Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4bptna0ctp-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 15 Jan 2026 08:30:09 +0000 (GMT) Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-7f66686710fso1103394b3a.3 for ; Thu, 15 Jan 2026 00:30:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1768465809; x=1769070609; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=yRAomd5/WndmqPt4/KPViCWMZ2kB08fk6+zB+UfeCDE=; b=C9zy3G2/fhozrSw1d8j4gsmVqjIG18Ur4GnbAWIhyJtaWO///onLNlFKq6c+E/HdQD AcRSqouRt5LZAY/7YL5APZES4LV5gQxscDKbEzn5iz5SGOjWhNhzZSoZOjeqwQMCH9lH J/vr1txG2CChW8x5rir0+2v7x14LinK0p6xt9Q4rbIWMjFiqGbIlAZEWpknB22jRUO8b wJYx1E+84JVzTBQv302kGw2HydTvB92IGgJhZc4mUo3em/iJhVyKSSzP/RAZjPvEnOUv YxXVp56W9Pg+mbNtpuFbazgM8S8W0f4ukZuMOl6ZUk5qkpIos9uEHPqANXlsUNf1lgE1 bf+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768465809; x=1769070609; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=yRAomd5/WndmqPt4/KPViCWMZ2kB08fk6+zB+UfeCDE=; b=RO3yM3gtQoI3W0o03iyhTd1YsvPQheqyepm4sgmr8XgN6/kK3Sh5ARna/5g20dsZ50 c4fBTlifaShjadQFiIuhczKjLnWW1KNyQvRd5s6vToqN39Ppk6KNOrYxWq2YxVK8jhxk vMvx3Iys2cH/Q+Z9OkWWTgtR5s3cYk9wX1LtaUjz2aDJPbA6gbkg18nBm+1gBqkbXBoC W4gRYNM0cYSZaRJbJ+mKOPvG1nCC/Xn+mWXmw3c76i+TqxB7yGs5wIGLcGxFLG1+AtRh HKrqK3QQQXxN2qxIpE5FZJs2z2hjkGFy2vp1FireFz+pBaJNUHb4t0tIPn2udfnXcdXS iMbg== X-Forwarded-Encrypted: i=1; AJvYcCXnnsljCyVxA6Ugis4fAg5nK/XwNXR22H+y3N9jDvkb5hG/YPb6MdD15zSCQv0EzDwZzuyxU5F/xsTXHbs=@vger.kernel.org X-Gm-Message-State: AOJu0YzFPKoSu1YxlR+adPNIUJE5LjrZnVBmJbIChvPWBo66LMyfi+ww 1fG95S851s5mSg2hRhgCBifDtcKpnGLPpcJbpIzEyYFoDdnGIdFWtnooAx6wr3i4C1sYHLISdgn hZ8+mtM9surIQo3dq5HSsG//bB9OYaMuDvTw4ZnKkvcWm78lEvpCuM1oDEgmNInja5Pc= X-Gm-Gg: AY/fxX4FzBNi+0XPvVdWxlEXiqLPSOvSf4/5AF3QlQ/qhFQss8sqzJgTWPGO7G7hJGR +sWcujD5lILvQdwjYb4GotK/c13GMlNntNwi5nt+8QU3Y0U6AcQrEu+rOHmnLOxC3dzdLeLyCtc PRRPrcHAix0alv8C491gYYDb7vwTaiA1r4uwxkwgINFaEw2B/SNAuzdomrDIr01/L/ZP1n3NNq6 9rZFuSrbVWExkGQ/GgI0WpBw2JoJfnss1/am/PMWMG0GkFaHmS5CtXe2SicdyyxsDV49burcjqn tHNodzxLk7XJn2j9j7QzqlgVp546niaYxdq4KPluTaqLyV0us65OuSHAGM26BsMBtv6XAjNUPDd +WObixrjo8rjbh/1SAsebTylua+So721RtPcMrV1m X-Received: by 2002:a05:6a00:b90a:b0:81f:2b84:6efb with SMTP id d2e1a72fcca58-81f82011df7mr6059472b3a.69.1768465808547; Thu, 15 Jan 2026 00:30:08 -0800 (PST) X-Received: by 2002:a05:6a00:b90a:b0:81f:2b84:6efb with SMTP id d2e1a72fcca58-81f82011df7mr6059441b3a.69.1768465808070; Thu, 15 Jan 2026 00:30:08 -0800 (PST) Received: from QCOM-SocCW5bzXR.qualcomm.com ([202.46.23.19]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-81f8e69d1e7sm1773296b3a.58.2026.01.15.00.29.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Jan 2026 00:30:07 -0800 (PST) From: Jianping Li To: srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org, linux-arm-msm@vger.kernel.org Cc: Jianping Li , thierry.escande@linaro.org, abelvesa@kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, ekansh.gupta@oss.qualcomm.com Subject: [PATCH v2 4/4] misc: fastrpc: Allocate entire reserved memory for Audio PD in probe Date: Thu, 15 Jan 2026 16:28:51 +0800 Message-Id: <20260115082851.570-5-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260115082851.570-1-jianping.li@oss.qualcomm.com> References: <20260115082851.570-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: FHP36NglIQddjIzNxG8CNnaj3cmDeJ_S X-Proofpoint-ORIG-GUID: FHP36NglIQddjIzNxG8CNnaj3cmDeJ_S X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMTE1MDA1NyBTYWx0ZWRfXyHMF4jF8mIeU wpRqSSHvshKdvJS3oCawryYTqwuLI9cL5ekEKr9nsYTW+RGUBvUIZOQ0ZS5Ws5F+Emmn07h+GKN cuhKBifpkTDR2uXNGtWijbGgMc2vJ5mUudcjuGMiNcOfilEljrSsEqBuFf3g4J8dMKg8eK7tz9H DeydPliPDDULo5ZXCuUJgfDJIfrIPEd+NifNtEFi7uRWHbPfwisbDCqcGJ147EbhIxrZ/tV2EOC yZph8nVB9BxxWP7ZOeZuC7B7G932ymlpT/xUVmOlHfvTnh3BibuNoquEgj/yp5qb+0KYr4W2Fps YlUG6vHpc+QMSO4cvJpSTfVwQfawGS4DWT0bhq1P45ndD0HS4tqouQkb5N3OSf/7NbPAS401s7S 5G+OLcTFm9Crmr95wTzUGhSWRZhg07OYXZm2K/IKOH/fwBhQPgor0nWXa/2McPnKMOyfXuHjO+o ZSW0Zfa+bmwyl62Ph/w== X-Authority-Analysis: v=2.4 cv=fsHRpV4f c=1 sm=1 tr=0 ts=6968a591 cx=c_pps a=rEQLjTOiSrHUhVqRoksmgQ==:117 a=j4ogTh8yFefVWWEFDRgCtg==:17 a=vUbySO9Y5rIA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=EUspDBNiAAAA:8 a=6yTI7Z6G2gYhkubfSC0A:9 a=2VI0MkxyNR6bbpdq8BZq:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2026-01-15_02,2026-01-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 priorityscore=1501 bulkscore=0 adultscore=0 spamscore=0 clxscore=1011 impostorscore=0 phishscore=0 lowpriorityscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2512120000 definitions=main-2601150057 Content-Type: text/plain; charset="utf-8" The entire reserved-memory region is now assigned to DSP VMIDs during channel setup and stored in cctx->remote_heap. Memory is reclaimed in rpmsg_remove by revoking DSP permissions and freeing the buffer, tying heap lifecycle to the rpmsg channel. Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 95 ++++++++++++++++++++---------------------- 1 file changed, 45 insertions(+), 50 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 833c265add5e..f9edca7a8de1 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -278,6 +278,8 @@ struct fastrpc_channel_ctx { struct kref refcount; /* Flag if dsp attributes are cached */ bool valid_attributes; + /* Flag if audio PD init mem was allocated */ + bool audio_init_mem; u32 dsp_attributes[FASTRPC_MAX_DSP_ATTRIBUTES]; struct fastrpc_device *secure_fdevice; struct fastrpc_device *fdevice; @@ -1304,7 +1306,6 @@ static int fastrpc_init_create_static_process(struct = fastrpc_user *fl, struct fastrpc_phy_page pages[1]; char *name; int err; - bool scm_done =3D false; struct { int client_id; u32 namelen; @@ -1334,31 +1335,6 @@ static int fastrpc_init_create_static_process(struct= fastrpc_user *fl, inbuf.client_id =3D fl->client_id; inbuf.namelen =3D init.namelen; inbuf.pageslen =3D 0; - if (!fl->cctx->remote_heap) { - err =3D fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, - &fl->cctx->remote_heap); - if (err) - goto err_name; - - /* Map if we have any heap VMIDs associated with this ADSP Static Proces= s. */ - if (fl->cctx->vmcount) { - u64 src_perms =3D BIT(QCOM_SCM_VMID_HLOS); - - err =3D qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr, - (u64)fl->cctx->remote_heap->size, - &src_perms, - fl->cctx->vmperms, fl->cctx->vmcount); - if (err) { - dev_err(fl->sctx->dev, - "Failed to assign memory with dma_addr %pad size 0x%llx err %d\n", - &fl->cctx->remote_heap->dma_addr, - fl->cctx->remote_heap->size, err); - goto err_map; - } - scm_done =3D true; - inbuf.pageslen =3D 1; - } - } =20 fl->pd =3D USER_PD; =20 @@ -1370,8 +1346,15 @@ static int fastrpc_init_create_static_process(struct= fastrpc_user *fl, args[1].length =3D inbuf.namelen; args[1].fd =3D -1; =20 - pages[0].addr =3D fl->cctx->remote_heap->dma_addr; - pages[0].size =3D fl->cctx->remote_heap->size; + if (!fl->cctx->audio_init_mem) { + pages[0].addr =3D fl->cctx->remote_heap->dma_addr; + pages[0].size =3D fl->cctx->remote_heap->size; + fl->cctx->audio_init_mem =3D true; + inbuf.pageslen =3D 1; + } else { + pages[0].addr =3D 0; + pages[0].size =3D 0; + } =20 args[2].ptr =3D (u64)(uintptr_t) pages; args[2].length =3D sizeof(*pages); @@ -1389,26 +1372,7 @@ static int fastrpc_init_create_static_process(struct= fastrpc_user *fl, =20 return 0; err_invoke: - if (fl->cctx->vmcount && scm_done) { - u64 src_perms =3D 0; - struct qcom_scm_vmperm dst_perms; - u32 i; - - for (i =3D 0; i < fl->cctx->vmcount; i++) - src_perms |=3D BIT(fl->cctx->vmperms[i].vmid); - - dst_perms.vmid =3D QCOM_SCM_VMID_HLOS; - dst_perms.perm =3D QCOM_SCM_PERM_RWX; - err =3D qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr, - (u64)fl->cctx->remote_heap->size, - &src_perms, &dst_perms, 1); - if (err) - dev_err(fl->sctx->dev, "Failed to assign memory dma_addr %pad size 0x%l= lx err %d\n", - &fl->cctx->remote_heap->dma_addr, fl->cctx->remote_heap->size, err); - } -err_map: - fastrpc_buf_free(fl->cctx->remote_heap); -err_name: + fl->cctx->audio_init_mem =3D false; kfree(name); err: kfree(args); @@ -2396,7 +2360,7 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *r= pdev) } } =20 - if (domain_id =3D=3D SDSP_DOMAIN_ID) { + if (domain_id =3D=3D SDSP_DOMAIN_ID || domain_id =3D=3D ADSP_DOMAIN_ID) { struct resource res; u64 src_perms; =20 @@ -2408,6 +2372,15 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *= rpdev) data->vmperms, data->vmcount); } =20 + if (domain_id =3D=3D ADSP_DOMAIN_ID) { + data->remote_heap =3D + kzalloc(sizeof(*data->remote_heap), GFP_KERNEL); + if (!data->remote_heap) + return -ENOMEM; + + data->remote_heap->dma_addr =3D res.start; + data->remote_heap->size =3D resource_size(&res); + } } =20 secure_dsp =3D !(of_property_read_bool(rdev->of_node, "qcom,non-secure-do= main")); @@ -2488,10 +2461,13 @@ static void fastrpc_rpmsg_remove(struct rpmsg_devic= e *rpdev) struct fastrpc_buf *buf, *b; struct fastrpc_user *user; unsigned long flags; + bool skip_free =3D false; + int err; =20 /* No invocations past this point */ spin_lock_irqsave(&cctx->lock, flags); cctx->rpdev =3D NULL; + cctx->audio_init_mem =3D false; list_for_each_entry(user, &cctx->users, user) fastrpc_notify_users(user); spin_unlock_irqrestore(&cctx->lock, flags); @@ -2505,7 +2481,26 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device= *rpdev) list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node) list_del(&buf->node); =20 - fastrpc_buf_free(cctx->remote_heap); + if (cctx->remote_heap) { + if (cctx->vmcount) { + u64 src_perms =3D 0; + struct qcom_scm_vmperm dst_perms; + + for (u32 i =3D 0; i < cctx->vmcount; i++) + src_perms |=3D BIT(cctx->vmperms[i].vmid); + + dst_perms.vmid =3D QCOM_SCM_VMID_HLOS; + dst_perms.perm =3D QCOM_SCM_PERM_RWX; + + err =3D qcom_scm_assign_mem(cctx->remote_heap->dma_addr, + cctx->remote_heap->size, + &src_perms, &dst_perms, 1); + if (err) + skip_free =3D true; + } + if (!skip_free) + fastrpc_buf_free(cctx->remote_heap); + } =20 of_platform_depopulate(&rpdev->dev); =20 --=20 2.43.0