From nobody Sat Jul 25 05:59:34 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BB2CA471431 for ; Fri, 24 Jul 2026 22:33:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932429; cv=none; b=kpsYVAsx8IQc2PLkB0DJ32SymLsz5r8lLaRY5NQRQVjCM6G02c3QcFBlc7SOJwBzYa1N7HMt2TPJETV/DcQ0eBh6eDRdFdy86D1Qso5kY58FeqJhrKQyNEUXYTS1M4ip5W3p/FqPivD8Ybe+NxIrn8o2xoNJWtwZu5avq2QGZDY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932429; c=relaxed/simple; bh=CLBqC99BDn2MJ6qbf62WJUrtyTuLzUq7nLojwyyw2KY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fE0cy/2EsCpj1MKCHn4QLBXMG5MYG1N0k1nW5mCJRESqZsU9I4zRHovR5sBhYk1Apze2bEjKrqowGBRuCm+RLkXgSup1+C904sOk20OiW5LgLmB1pXo/4/R6iu75Id5ga5yRY0NnhoE2W0/bGbSFakDfyz1utx4Z+AA38EB+LYc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ZhvfXwnQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZhvfXwnQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B24E31F000E9; Fri, 24 Jul 2026 22:33:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784932428; bh=x5SLjYjGlkUmOBLlLeMwyak86cKmhH86brefOh2GTvA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ZhvfXwnQTwrf/oGIq5Fojct7D6sFeNVEG5IP8kshIqQs03kq9GPQTgvxJlJdELgYe cr5ctHx7kr8gDEaatiuw4bKqjEDie3oOOdlY4ALydFnQ1dB/NCi3ddJctsVxqSzsEU fRi42GD/fueJy9qxp+TlQ0uwwzsHkAefXZwCJUwdk4r61o2sejDOdS0TKAvSOBxBpb 5QMT5/bsMaD2RyY4gi49dmK366m3gZEv+YZSXrIA2HKI6arsA4PGYMGeYkyNZ2f1HS iB/8sauxGmMIL/kONVOni3bKrar7dUzNumpbzgGmYLeuZe1NwfejWR7sZrDLy/8iki q+i5wuVSUB+Lg== From: srini@kernel.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Ekansh Gupta , stable@kernel.org, Dmitry Baryshkov , Jianping Li , Srinivas Kandagatla Subject: [PATCH 1/5] misc: fastrpc: Fix initial memory allocation for Audio PD memory pool Date: Fri, 24 Jul 2026 23:33:37 +0100 Message-ID: <20260724223342.629168-2-srini@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260724223342.629168-1-srini@kernel.org> References: <20260724223342.629168-1-srini@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Ekansh Gupta The initial buffer allocated for the Audio PD memory pool is never added to the pool because pageslen is set to 0. As a result, the buffer is not registered with Audio PD and is never used, causing a memory leak. Audio PD immediately falls back to allocating memory from the remote heap since the pool starts out empty. Fix this by setting pageslen to 1 so that the initially allocated buffer is correctly registered and becomes part of the Audio PD memory pool. Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") Cc: stable@kernel.org Reviewed-by: Dmitry Baryshkov Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index f3a49384586d..4f01ebfa6f95 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1370,7 +1370,9 @@ static int fastrpc_init_create_static_process(struct = fastrpc_user *fl, err =3D PTR_ERR(name); goto err; } - + inbuf.client_id =3D fl->client_id; + inbuf.namelen =3D init.namelen; + inbuf.pageslen =3D 0; if (!fl->cctx->remote_heap) { err =3D fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, &fl->cctx->remote_heap); @@ -1393,12 +1395,10 @@ static int fastrpc_init_create_static_process(struc= t fastrpc_user *fl, goto err_map; } scm_done =3D true; + inbuf.pageslen =3D 1; } } =20 - inbuf.client_id =3D fl->client_id; - inbuf.namelen =3D init.namelen; - inbuf.pageslen =3D 0; fl->pd =3D USER_PD; =20 args[0].ptr =3D (u64)(uintptr_t)&inbuf; --=20 2.53.0 From nobody Sat Jul 25 05:59:34 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4853B471D00 for ; Fri, 24 Jul 2026 22:33:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932431; cv=none; b=SIpCOyEsVU6r7rDoFUywoNRYKqb/xJlhBs1pecKmwQDDD8/zAxyIxGXJcQsoCMpGePYA1f/9WPOJHORKTpjxBLlEcv/I1dk+MHehvD7Qo+u9fcz6/BEjAoIR089kV7sr1Yd6YioPnE22lXnAdmHX/XuVqouYhpIv4nXeLxIP/p8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932431; c=relaxed/simple; bh=zxAUBmki0hoMzwzRFtRrwN7bEtYyFXkoyPW+Z4z4FEw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=s/uWmp50tI+ypqLT/NrAzphmNHr7IskeaauXZ+C+p8GYpUYF5Jlb3/owTGo/4zHJp2k5yTN0nPQoAQzvkCD3441CmFzpMCOs5VAZoO2xaWgrDUyHq3zGTkijUDB2XjdkyNmrQeXICI0tvLRY3bYJLGta09zGQa87LguzzK9MyeY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=D/vfjiZE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="D/vfjiZE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BE1C1F00A3D; Fri, 24 Jul 2026 22:33:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784932430; bh=wdpSEkTXHl2CC+FXG9BoypmYetlzzyXbprvrW2ww2H0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=D/vfjiZEymyru6MPCXtgNQ/eyuI77FileRDe4dSc3yTMKGFYTFFaQ12BZ7RCN16dv 7+wuTE8IMNNSIUgBK2H+ULOvbdRxXCuyKrbiandT18GEFOnHrOHTNor2zkTNT47uxr WuVU9mrIYG33Lo7lIOy9YzvSbPx7u6kNM635OpwVAt4xglHvtkgOo+GaKJ3iIRQILz ab6O7Bh6PIfeL1uvlLNMZ6Q012tPOel0O2BFuRIDhaTBaC7IDaccL7v9Ayw74UyGQ3 H620E+eTYCbHPPQC2uZdNN84cc+Uke8vfEYGyYqMgjkDQmO+F5XSen8cyLvGrCvOL3 RAEpINfFo3wvQ== From: srini@kernel.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Ekansh Gupta , stable@kernel.org, Dmitry Baryshkov , Jianping Li , Srinivas Kandagatla Subject: [PATCH 2/5] misc: fastrpc: Remove buffer from list prior to unmap operation Date: Fri, 24 Jul 2026 23:33:38 +0100 Message-ID: <20260724223342.629168-3-srini@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260724223342.629168-1-srini@kernel.org> References: <20260724223342.629168-1-srini@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Ekansh Gupta fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if multiple threads invoke unmap concurrently, where one thread may remove the entry from the list while another thread's unmap operation is still ongoing. Fix this by removing the buffer entry from the list before calling the unmap operation. If the unmap fails, the entry is re-added to the list so that userspace can retry the unmap, or alternatively, the buffer will be cleaned up during device release when the DSP process is torn down and all DSP-side mappings are freed along with remaining buffers in the list. Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Cc: stable@kernel.org Reviewed-by: Dmitry Baryshkov Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 4f01ebfa6f95..12dcd2e737c3 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1889,9 +1889,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_use= r *fl, struct fastrpc_buf * &args[0]); if (!err) { dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); - spin_lock(&fl->lock); - list_del(&buf->node); - spin_unlock(&fl->lock); fastrpc_buf_free(buf); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); @@ -1905,6 +1902,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl= , char __user *argp) struct fastrpc_buf *buf =3D NULL, *iter, *b; struct fastrpc_req_munmap req; struct device *dev =3D fl->sctx->dev; + int err; =20 if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1912,6 +1910,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl= , char __user *argp) spin_lock(&fl->lock); list_for_each_entry_safe(iter, b, &fl->mmaps, node) { if ((iter->raddr =3D=3D req.vaddrout) && (iter->size =3D=3D req.size)) { + list_del(&iter->node); buf =3D iter; break; } @@ -1924,7 +1923,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *f= l, char __user *argp) return -EINVAL; } =20 - return fastrpc_req_munmap_impl(fl, buf); + err =3D fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); + } + + return err; } =20 static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) --=20 2.53.0 From nobody Sat Jul 25 05:59:34 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 113C8471CE7; Fri, 24 Jul 2026 22:33:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932436; cv=none; b=FlL6oP9EbOC2CEco1HbFKEJ0SXcincnTTicZjwDHZ8fZrvjXsLQFAz4obS90ST1ToAhimGlv4X+T8QGGjbjkAXobfyrVs4ApMu3C4yeMAqz504uSLLqLx5hWcqL9Pt63xYhzUEOkpinezaTI6OBaAE4ACfX8wWeTH4ybqVRiq7Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932436; c=relaxed/simple; bh=PUeOkzZuAYY/8odiO0Mm3JnDtUkPjjC+85qgirmGOmk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=W4NAS7S8FtSXAFFBeyb2OFjbE+UqzU5DorzTTM6VPqHRP3NwfUMiIrm4m4Im3aqXGoEu7mOsTRRbY+k84xg+B/xa/EeZQb0aKPchsu8cqSFgYh0h/rVHAo/S4Ez8RPx1HNHS9kphC4oV6HOjehiah4C6FjFjJJS6AqpzOtvrwjo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=oUGLBwRP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="oUGLBwRP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 624BE1F000E9; Fri, 24 Jul 2026 22:33:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784932431; bh=FJWB2LGl36ZCSAJ9K238RNzndOpMva91W3SzDFj9ZgE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=oUGLBwRPY/U8pNewb5HiIQiGzkkO0TQYh6NiDXMjJMWFAmBuWmyo/q+oghFbkq8be aztRLsdNDkjf/yjyo6dwnQ90ZcRqe8bofORQf86U7U/x1HgfPQrSfa+I2RRfiB0EiG Nv3+PxRRS9+ahPhFKN8Mfj7PphuAzdXETmCl7ijiY20k3BWHMzCcbR3e2RHmlUB/BH 2bBrnMQZFsR8VyMsaxW2iQbN9FMYHi7BXpkYkojYsxwKyuFle53E2dsYPWAMQ0FqMR Yy4H6qVVoaCTE+FkYbT7YR3WFmBMjE/J+ngaS/IUViHuo7BIfUuofnM1I6oM4YTNLU e5J0NFpNVhhEQ== From: srini@kernel.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Junrui Luo , Yuhao Jiang , stable@vger.kernel.org, Dmitry Baryshkov , Srinivas Kandagatla Subject: [PATCH 3/5] misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke Date: Fri, 24 Jul 2026 23:33:39 +0100 Message-ID: <20260724223342.629168-4-srini@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260724223342.629168-1-srini@kernel.org> References: <20260724223342.629168-1-srini@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Junrui Luo When an invoke is interrupted by a signal, wait_for_completion_interruptible() returns -ERESTARTSYS and fastrpc_internal_invoke() moves every buffer from fl->mmaps onto cctx->invoke_interrupted_mmaps. This list_del()/list_add_tail() walk runs without holding fl->lock, the lock that serialises fl->mmaps in fastrpc_req_mmap() and fastrpc_req_munmap() everywhere else. Take fl->lock around the move, matching every other fl->mmaps accessor. Fixes: 76e8e4ace1ed ("misc: fastrpc: Safekeep mmaps on interrupted invoke") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Reviewed-by: Dmitry Baryshkov Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 12dcd2e737c3..c75eafe872cc 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1305,10 +1305,12 @@ static int fastrpc_internal_invoke(struct fastrpc_u= ser *fl, u32 kernel, } =20 if (err =3D=3D -ERESTARTSYS) { + spin_lock(&fl->lock); list_for_each_entry_safe(buf, b, &fl->mmaps, node) { list_del(&buf->node); list_add_tail(&buf->node, &fl->cctx->invoke_interrupted_mmaps); } + spin_unlock(&fl->lock); } =20 if (err) --=20 2.53.0 From nobody Sat Jul 25 05:59:34 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 783F0231835 for ; Fri, 24 Jul 2026 22:33:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932436; cv=none; b=lECFgL1FC6KpV3fzs96jav0EBYPpG66gpcqGCSltumj5tT2oW+Jr9aqJzEIU5Y4DZ14HXXGrICFPrFpqOYhOJ9VpDv+AKEFiu9xqIqUclQmwe9qlBL2HTFzxE4JciJeMdbDrhWpQDmtw+Dvo4rkC8HWqQdN/Qq85i5YSbEJLqGQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932436; c=relaxed/simple; bh=dP7nKuPuBJhotcoN9NwLo3xpovYwPjanldtFnpU4aOI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=L3HtMfKjd3/G+7hmSt4fWxjWh550Cbc6NyCfdHjTZTKyZQxefmMDmhfdxwchsQngjSyNlHF+4Qc5Ph0H/S+ocF5NI98ETLcfCJwVTN6/cqWxqHCmt6LKA+BZSH6K7lpOR5h4SczD+gqYVeNA6/yXHU9DzF/nnM090RAE5313BVE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=IlqaaxaG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="IlqaaxaG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3AA0B1F00A3A; Fri, 24 Jul 2026 22:33:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784932433; bh=s89KiDMZ01+E7QbCJC5Aj9GP2pBNaHlqeVh/1/9ICP8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=IlqaaxaGIpetTgenK8e8Ot2Cp8xlRrNtqg8EKylxgDSrdIX0b/PhZAmjYtddarZMN E5JeGRFdbrOgRKw120A0jQjksUtWsuy90WUtZDnDpxXKEp68ix/jlbOUZqR/9TMz5+ CqFdL76diDaJcjvB5EppxHB2WSW0qWACvlBGvn9jJyD6kGy89YEe4mKTESDWMSJYgV OF5nilgP6VIU7PZQH/M6CwFrLogU09MJXkYoallN10G+HBnXmYJXnJx7V9m0WKzFlq NXIulZZ4+FlMxS1bKTLG/t/63ImZ1TcfMwGqUihUSvQNWOOJ1BCDoo/u8jRYm2q2z2 5hlzUytZNtJRQ== From: srini@kernel.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Anandu Krishnan E , stable@kernel.org, Dmitry Baryshkov , Srinivas Kandagatla Subject: [PATCH 4/5] misc: fastrpc: fix channel ctx ref leak when session alloc fails Date: Fri, 24 Jul 2026 23:33:40 +0100 Message-ID: <20260724223342.629168-5-srini@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260724223342.629168-1-srini@kernel.org> References: <20260724223342.629168-1-srini@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Anandu Krishnan E fastrpc_channel_ctx_get() is called in fastrpc_device_open() before fastrpc_session_alloc(). If session alloc fails, the error path returns -EBUSY without calling fastrpc_channel_ctx_put(), leaking the reference. Fix by adding the missing put. Fixes: 278d56f970ae ("misc: fastrpc: Reference count channel context") Cc: stable@kernel.org Signed-off-by: Anandu Krishnan E Reviewed-by: Dmitry Baryshkov Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index c75eafe872cc..f8cbe30c5d5c 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1675,7 +1675,7 @@ static int fastrpc_device_open(struct inode *inode, s= truct file *filp) dev_err(&cctx->rpdev->dev, "No session available\n"); mutex_destroy(&fl->mutex); kfree(fl); - + fastrpc_channel_ctx_put(cctx); return -EBUSY; } =20 --=20 2.53.0 From nobody Sat Jul 25 05:59:34 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 784963F482D; Fri, 24 Jul 2026 22:33:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932437; cv=none; b=r0YCuj31DIMcWpylwql9FFPaCtj94HaH3xaKzybZw1G9wbUjRkxDlUxIw1rayIDcU8KtjMs4cCKQpXu1n7xqPst37nO8NDoxbkUy3KjTCobWgZtR2qmTZkgMdee70BD8AL+R9qKh5CpypU5r0zJh3h1z4hNEkBE0nkcTMbqwcQY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932437; c=relaxed/simple; bh=+hm62uNx5Nt9QktjrLRNaBxvbigeLcRFHFoxY37oqw4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ueu3xFVt/G9HmGzjHfZaOn+659u/fREAtT5A5UejKjo2GF0VzkcnChj4BDTCLIIeWn+cAEwvAQxL6CvkaCEhvblBm59k0CE/Ql1TGrnTGoi3wPLzsK5IiRJwHXId+Mu0tZZXuS4hsBHjm7+l/Nboyrdcljgrl6w5RVxYpe3Va9M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=owZGQHVk; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="owZGQHVk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2CF61F00A3D; Fri, 24 Jul 2026 22:33:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784932435; bh=ljnoWx5eorV9w+2zpeNyCq0Qijcg2gSirzinnZYNAhA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=owZGQHVkZZYVh5EbhUqe1ldV4sHe/YclbdzrJuW0XDQu5OLXowZqY/vw3JDYd9yEg eWFPxCQhzqIR62kRk1ZeTEVf3GncpKn2AivvG8W+4hIVxGA43TKgWhs/LAIGRGj6I+ 1uqE4HhnZBlDgoGWeq5ipXST8UUHuoiz1rx9FwAfzkdrt27t1ITxP6cdqbsPTVGEP3 h98D6HYuTR+QWw3T8xB1qOEECjdgfjPCM3k78LlWG7MpzG/xtBP8URCb1bUQP4/dFy PVIqyA02lBzb3yvF/PDjZCWdzGl0opWVMVaIkEcboX/cEhADSnUEkFULAQvsAuGNgt FWGeuV5pMzaQg== From: srini@kernel.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Eddie Lin , stable@vger.kernel.org, Ekansh Gupta , Srinivas Kandagatla Subject: [PATCH 5/5] misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Date: Fri, 24 Jul 2026 23:33:41 +0100 Message-ID: <20260724223342.629168-6-srini@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260724223342.629168-1-srini@kernel.org> References: <20260724223342.629168-1-srini@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Eddie Lin The 'ctx_idr' is initialized but never destroyed when the channel context is freed, leading to a memory leak. Add idr_destroy() to properly clean up the IDR resources. Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver mode= l") Cc: stable@vger.kernel.org Signed-off-by: Eddie Lin Reviewed-by: Ekansh Gupta Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index f8cbe30c5d5c..eb6c2a78d3c7 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -492,6 +492,7 @@ static void fastrpc_channel_ctx_free(struct kref *ref) =20 cctx =3D container_of(ref, struct fastrpc_channel_ctx, refcount); =20 + idr_destroy(&cctx->ctx_idr); kfree(cctx); } =20 --=20 2.53.0