From nobody Mon Feb 9 19:26:55 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D8408333720 for ; Thu, 15 Jan 2026 08:29:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768465800; cv=none; b=izkUdutabkrVnJ+qI8QgWlKhzMJwGPdo78/6rpNjW/RfSvsgShkm6A7JBQFQBv/faej19DRyQHwqFDGMkgpivrjGNQaufB2pDHPgN9vNgMBFP2gqeJPlPHtTT29oIIssVIXmEaLJ5MFBUE8OfcMdTJMH1Fc871Gj5ibeJyXmoG8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768465800; c=relaxed/simple; bh=VCRsiSWmBZTWoniAiDuhukrpl8fYTCpGwB7tOHtDVsw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=kUEWuU7ihxeuprptw3APzQVn1m1UKhoRo6zIDYFDDFNoeaB84YmMrHtvWoSxg0TBJc68R2YLQq4C6gnkwm3Ox3oEE3/XG9+mIx2NLFwJVtyUKiDJPx6D6XsdSIia9eEH/QJQtOXwaw0qPwC5bXXh9ChLWINjnBUOd5M2bbrouOQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=JpRj1lqI; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=TtnialaF; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="JpRj1lqI"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="TtnialaF" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 60F6frOZ1582040 for ; Thu, 15 Jan 2026 08:29:52 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=12vcQeB7vtt +410hwakfDxk9ykcl1qmLQ2Bo+92glU4=; b=JpRj1lqImLTb4jPLxwNJf6PGwh+ R4DUfocyLZEugvuOkB9EttRFJvUCYqsqhfw84CC+fe/wvO17O5fSntJhciOAXXpD 5I4K2vtUhakIWW3QdOucZ3xa2/t+4iw7vMwVY2sBAfjreskxNR0cnK/k3pHIIqWl BU5P0F76cbLedbqdUOhcvfcPI5Rh3+k5eLWTl0XmDPcEcvvENxkqXOyv3anq0G2r PBBlfYE0ecdYzyA3E5lWk8uyer3FQHzQYXmKsTdg/xStnbrfmlj8MnO99HGDWaXj 4WhHVjSyfOFbiMvjfoZw5Oz+/glZgAA4gYDrFie3Jbbta6hWxxgbbNAVqwQ== Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4bpj1pst4d-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 15 Jan 2026 08:29:52 +0000 (GMT) Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-81f53295ac2so1459055b3a.0 for ; Thu, 15 Jan 2026 00:29:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1768465792; x=1769070592; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=12vcQeB7vtt+410hwakfDxk9ykcl1qmLQ2Bo+92glU4=; b=TtnialaF6JLmw5+hO2bRwz26D9KPnjd476tuW4hZUVVXSMb2tgsJh245ZbNp5/PG7Q l6E+2O5SdmfB5Dsahe4CFSKZOq2fYXKNh48XiR6oVyCXSCpfVhXk3zgrJroEFAwEPRzv dDmew1wnHUx/LHtWSD0ZyFUBc/iEMiHphrzOlNYbF3USNmwlb7P2HdY8ZpVWdI/qSVP7 5UMxMt0HfURm0Ru/EPsyQkDQ8ajJXsjxS9pmldEqwYV4QrUrqC+558q1uzvOHCjsmDtr FOt678WOTBHM1ZENkgrx4oSAxN33um/4+o5FH87fDbiuZ6udaxZ6uh52et9tQm6SBCAr Bt3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768465792; x=1769070592; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=12vcQeB7vtt+410hwakfDxk9ykcl1qmLQ2Bo+92glU4=; b=sZAZJyRI+0WvxwHWYrhGGxktgwxnc7e9E+4iIZ39ZxSrB0yfs3qGudWyC9ocWCBqfP 0kXsG0/930r6zyQiVIw8dLIvv3Iy9AYBZ1uYJBgu7OnOk1nwa5IeT/LpJg3q5zNHaxHU 5dVebtblxMFStn9IqqFSScWjy1ujVKk6VXL3dDWb9opu4TYKFvRyr0HBLSRXBxpODTep hHN3idoyDpreWlGgr3O+zqjdaAOw1AX0ASPTRq4voA2lxov/RZDvCVFXo9O1/9B4fxGs e3fnm32oq8sRNgHRegRiccrjYpOBv+WPBdRE7VREUmolKXzQ5LO+Z5gRGbj+X9nNKyYz koVw== X-Forwarded-Encrypted: i=1; AJvYcCWf0QLCSf3xeE5F7MGjhe2tZVOcTnylSW7BRVT8P8lv+FXn/CM3yLExf4cC0lcTFLI8NnZNmi/YWAn4wBE=@vger.kernel.org X-Gm-Message-State: AOJu0YyGCzgAJPf4h3O8OW9C5u0WRl3sLLY3YWtdlJWaS30gU0Ayo7B9 HOmHVTpv0kHlD7qdybdSTIiariR0pdm+B7sh4p9JmntOfVeCsvkk7S1sJLPf2aqReBkWYpEBTOt kyWitglej50RL5l2sC27zvQxYCFcBNkDwQcs8XoNtkxNQBcOx3LOsEtRBnlTrTVFMQHE= X-Gm-Gg: AY/fxX57wNkrtTn63PDNkK/haU/JXxbRC9Gr8rikW/wHFn/FMjgYdMm4XZPjmUDhEFa Qjn4x22zRIieuE6ApDz5NHgYdvnUp/K07YwyXbfLkIboolxqvnkDcB+RXfxkKGkzczEyMbFpEfs 4qBHMjZxhzBM66E1ONQ6zhKi/3ADvp1reBf0PGFTbQdciXoEMYVhLAQwbjim+Td4dR8Z05/griq ILbsMJq80ye8bB533yRIewMUrGlH/i8HJh0TkgFNxo3LeVI1yG6fdf8vnnlOyrPX51J9m9ASwAw vTnkm7K0HvG+2GSNPTZd5kUPd+paYmDenpdyevgge5SwZc7dyMmbdR21PGfnrLpRbaQxl9Dk21z 3+m70O5rnGCaOii+vm4RIW3sTTTOfjP/kqPzWCqfH X-Received: by 2002:a05:6a00:ac03:b0:81f:5acb:55e7 with SMTP id d2e1a72fcca58-81f81fe0a08mr5626386b3a.54.1768465791732; Thu, 15 Jan 2026 00:29:51 -0800 (PST) X-Received: by 2002:a05:6a00:ac03:b0:81f:5acb:55e7 with SMTP id d2e1a72fcca58-81f81fe0a08mr5626370b3a.54.1768465791237; Thu, 15 Jan 2026 00:29:51 -0800 (PST) Received: from QCOM-SocCW5bzXR.qualcomm.com ([202.46.23.19]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-81f8e69d1e7sm1773296b3a.58.2026.01.15.00.29.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Jan 2026 00:29:50 -0800 (PST) From: Jianping Li To: srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org, linux-arm-msm@vger.kernel.org Cc: Ekansh Gupta , thierry.escande@linaro.org, abelvesa@kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org, Jianping Li Subject: [PATCH v2 3/4] misc: fastrpc: Remove buffer from list prior to unmap operation Date: Thu, 15 Jan 2026 16:28:50 +0800 Message-Id: <20260115082851.570-4-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260115082851.570-1-jianping.li@oss.qualcomm.com> References: <20260115082851.570-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMTE1MDA1NyBTYWx0ZWRfX0mxJ5GzK1S1H wFS60fu0C33V0J03OVvVefYPCY2Z54W/BpAifw6Z8KCB8CBhsu2R5k9LiuuGpEuE5TTUYjOtb/I 5PbQTVniOhR2750pntdj88QpPpRDANWm3M9WFljSKqR9sm8X/rdCRaPmV5009nsiw8DlWmAuJ6D K6YxkbQARAhfojc1Sk7NQpQSY7nD1PMmwrzeC439kJ7Os8ZB+2pIhEpFtFRRTwPoWy31WLYvORN JURHGRHEoGO/BS+Th5PBMNWiBTG5oz54JhlJ8N5eWQ8SwunRvMHSwExssYaHMWKziWR5CfBsjU7 726pYgpEOMm7IWowAGtOUZtFCISBMemw4ddaOMazVvzm6oWPtAZ9bcdEbdlHHwOg7JrKyEz2N4/ 4LLxhKeZHv1nXWODIaYJ0Ew5X8fj/l//l/EPTjJ9kxtuWBZ/bcCUUCm0DWxWVGA/njUW9kxuL8g aWRZjLD1NPG3HbJFltA== X-Authority-Analysis: v=2.4 cv=J+KnLQnS c=1 sm=1 tr=0 ts=6968a580 cx=c_pps a=WW5sKcV1LcKqjgzy2JUPuA==:117 a=j4ogTh8yFefVWWEFDRgCtg==:17 a=vUbySO9Y5rIA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=65MDuzgJ9_6jycvYPFoA:9 a=OpyuDcXvxspvyRM73sMx:22 X-Proofpoint-GUID: nsVyk6YFP_wJcJdb9onSRLAayffZ-YEh X-Proofpoint-ORIG-GUID: nsVyk6YFP_wJcJdb9onSRLAayffZ-YEh X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2026-01-15_02,2026-01-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 adultscore=0 priorityscore=1501 bulkscore=0 phishscore=0 clxscore=1015 suspectscore=0 malwarescore=0 lowpriorityscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2512120000 definitions=main-2601150057 Content-Type: text/plain; charset="utf-8" From: Ekansh Gupta fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if any other thread removes the entry from list while unmap operation is ongoing. Remove the entry before calling unmap operation. Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 4f12fa5a05aa..833c265add5e 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -202,6 +202,8 @@ struct fastrpc_buf { /* mmap support */ struct list_head node; /* list of user requested mmaps */ uintptr_t raddr; + /* Lock for buf->node */ + spinlock_t *list_lock; }; =20 struct fastrpc_dma_buf_attachment { @@ -441,6 +443,7 @@ static int __fastrpc_buf_alloc(struct fastrpc_user *fl,= struct device *dev, buf->size =3D size; buf->dev =3D dev; buf->raddr =3D 0; + buf->list_lock =3D &fl->lock; =20 buf->virt =3D dma_alloc_coherent(dev, buf->size, &buf->dma_addr, GFP_KERNEL); @@ -1865,9 +1868,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_use= r *fl, struct fastrpc_buf * &args[0]); if (!err) { dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); - spin_lock(&fl->lock); - list_del(&buf->node); - spin_unlock(&fl->lock); fastrpc_buf_free(buf); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); @@ -1881,6 +1881,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl= , char __user *argp) struct fastrpc_buf *buf =3D NULL, *iter, *b; struct fastrpc_req_munmap req; struct device *dev =3D fl->sctx->dev; + int err; =20 if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1888,6 +1889,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl= , char __user *argp) spin_lock(&fl->lock); list_for_each_entry_safe(iter, b, &fl->mmaps, node) { if ((iter->raddr =3D=3D req.vaddrout) && (iter->size =3D=3D req.size)) { + list_del(&iter->node); buf =3D iter; break; } @@ -1900,7 +1902,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *f= l, char __user *argp) return -EINVAL; } =20 - return fastrpc_req_munmap_impl(fl, buf); + err =3D fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(buf->list_lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(buf->list_lock); + } + + return err; } =20 static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) @@ -1985,20 +1994,23 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl= , char __user *argp) } } =20 - spin_lock(&fl->lock); + spin_lock(buf->list_lock); list_add_tail(&buf->node, &fl->mmaps); - spin_unlock(&fl->lock); + spin_unlock(buf->list_lock); =20 if (copy_to_user((void __user *)argp, &req, sizeof(req))) { err =3D -EFAULT; - goto err_assign; + goto err_copy; } =20 dev_dbg(dev, "mmap\t\tpt 0x%09lx OK [len 0x%08llx]\n", buf->raddr, buf->size); =20 return 0; - +err_copy: + spin_lock(buf->list_lock); + list_del(&buf->node); + spin_unlock(buf->list_lock); err_assign: fastrpc_req_munmap_impl(fl, buf); =20 --=20 2.43.0