From patchwork Thu Aug 29 09:29:25 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Srinivas Kandagatla X-Patchwork-Id: 172551 Delivered-To: patch@linaro.org Received: by 2002:ac9:5c4b:0:0:0:0:0 with SMTP id r11csp2072344ocp; Thu, 29 Aug 2019 02:30:01 -0700 (PDT) X-Google-Smtp-Source: APXvYqwNvchI7v8ngZ6sWzx+RiGgg9+wgm70xslP+HC5oBJn9HtlcgzD95y4/D9+BgiJ9caJ/z88 X-Received: by 2002:a63:3dcd:: with SMTP id k196mr7464706pga.45.1567071001184; Thu, 29 Aug 2019 02:30:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1567071001; cv=none; d=google.com; s=arc-20160816; b=jRAF5oy4Ni24wi9fMPt9lxPV2WvzjAEekiHk0d66ImXJM6wtsJ9jP/gtJfLMblGT7g P8kwvNPXEx3DSP65sZpnTxzZw1B0G7Sexv7+peDzOJyGj1qzTw+STrCsNHu7r7+xLs1c sPdmEieNhaH+UW7cqOmCx9S5r8oyCF2WoJ56AnPC4K0u9YiMax0uk4vhldEnUtt+Rfmd IUsUVQaO1PPhB12MVWh9nrH1Kf3DFRlW/5cKrAQImQ2pDXIs7QiaHNWS5c4emcUMl2Ye rjAcGUbLfwwzgSHkuDLFj6NJuKbatXsd3X1bicCELjoKsCnqHxXwoMW3a641aYdzds6N n5Qw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=7K2iZxOhWYqdpgu+ftGX/anH+28e+S9dJx0eG5WBrFs=; b=T+X3usbKM6fHr8n9rM31jwpX6gsR5IDDLMlRCsJzRlbKYZoCUOInli7M9J5IdOiIeH cI8Zy0jmYPeeAMpX3WPfB4kqcMOhqVlbDOMh/3PPyDpoZWhzyjVs7X2kDrSu8ceYL6sO jpeXTODwICRytsoVX0u8mOw0TKV7h53M0Zb3gBgJ83dofGu8PPgakrN8EBC/0S2VHJEF SUmZyw63LMN+TaW5BFI8h7mG1HZvC29xaLdAA01anT39tgJVcBXL0ppasuHANwrVfdcc TYvN5o6DyxAcLV7x1TdH4qj5WwdmvPxB59W6cCh1h8lKt/N+NphvuEvdKI6/Zqi+x0fh BU7A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=oiVT9zLm; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id e2si1460220pgf.256.2019.08.29.02.30.00; Thu, 29 Aug 2019 02:30:01 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=oiVT9zLm; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727213AbfH2J37 (ORCPT + 28 others); Thu, 29 Aug 2019 05:29:59 -0400 Received: from mail-wr1-f65.google.com ([209.85.221.65]:34180 "EHLO mail-wr1-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725853AbfH2J3k (ORCPT ); Thu, 29 Aug 2019 05:29:40 -0400 Received: by mail-wr1-f65.google.com with SMTP id s18so2706953wrn.1 for ; Thu, 29 Aug 2019 02:29:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=7K2iZxOhWYqdpgu+ftGX/anH+28e+S9dJx0eG5WBrFs=; b=oiVT9zLmf1h4t60P+I9CdvSij40tIxqhF78DG2hIgxWZ5HKvR0HrJISlbt6lpEsCG5 fC+esGCCHY34XbPFe1pyBtp+Tvn2h3uf4qdcm0cUCom7AxdwXYpYD/zDkq3x6lLo5YU5 5YXxHItF+lOOR2mqLSIeA7402VJFl250EKAhM9Wo4iuNf5Z54WKxqAEbuyQzQjAdEOx3 GEXbr6w6bfk6hOFmFZ9klwRBzqw9EIFHZyMVzW7O+COGimlsjq1L5u2mdXfkzu6/p85M nadOZG8Dvj7AwH+BDwuyFr9TdmBsDlnc7Ct4okKhHKUiW+c2L4sq7Ks+SkPhHPN7asUz fPqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=7K2iZxOhWYqdpgu+ftGX/anH+28e+S9dJx0eG5WBrFs=; b=L2XNSwhJh8l7rKkV4B7yv/9Qu7vSF63KTbYrBwdzrnQzMuF0EsawIwPQA9WsQm/qu/ uorSeh52tMSkpHw9/ukQQ9poWsq80sdDnud+NS/iA8gSwjSB6H0rnOnrDMnf/rW1CPSA CoYn6DcnciR+CCPuoHdoYb8kmlLnDuVCSkx0YTl5mkLNEgia6MpNoluTo/H112sXGumD sC6bBuWomuwPt/oaX5St9RvvKJsqUqpMFgCYWm/9uQ+B5LSEHS7u3DGHb949nXYEDwsU LwHJdC75WPZDkdwHZ3sLpNa5Nz3rb3MGlubiDy2rh3NdJNZNOTunA8dlnYYHWvRG/w4z bplA== X-Gm-Message-State: APjAAAVulDWZXBl4lnzHO1+O6IvGJmPhOBTTY79eFq1WpOXuZtdQqpm0 2EUEAfcT2wMG0nI0oJ4QrFlBEg== X-Received: by 2002:adf:ecc3:: with SMTP id s3mr10359603wro.302.1567070978988; Thu, 29 Aug 2019 02:29:38 -0700 (PDT) Received: from srini-hackbox.lan (cpc89974-aztw32-2-0-cust43.18-1.cable.virginm.net. [86.30.250.44]) by smtp.gmail.com with ESMTPSA id f197sm3609512wme.22.2019.08.29.02.29.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Aug 2019 02:29:38 -0700 (PDT) From: Srinivas Kandagatla To: gregkh@linuxfoundation.org Cc: arnd@arndb.de, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Srinivas Kandagatla , Mayank Chopra , Jorge Ramirez-Ortiz Subject: [PATCH v2 4/5] misc: fastrpc: fix double refcounting on dmabuf Date: Thu, 29 Aug 2019 10:29:25 +0100 Message-Id: <20190829092926.12037-5-srinivas.kandagatla@linaro.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190829092926.12037-1-srinivas.kandagatla@linaro.org> References: <20190829092926.12037-1-srinivas.kandagatla@linaro.org> MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org dma buf refcount has to be done by the driver which is going to use the fd. This driver already does refcount on the dmabuf fd if its actively using it but also does an additional refcounting via extra ioctl. This additional refcount can lead to memory leak in cases where the applications fail to call the ioctl to decrement the refcount. So remove this extra refcount in the ioctl More info of dma buf usage at drivers/dma-buf/dma-buf.c Reported-by: Mayank Chopra Reported-by: Jorge Ramirez-Ortiz Tested-by: Jorge Ramirez-Ortiz Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 25 ------------------------- 1 file changed, 25 deletions(-) -- 2.21.0 diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 38829fa74f28..eee2bb398947 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1198,26 +1198,6 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp) return 0; } -static int fastrpc_dmabuf_free(struct fastrpc_user *fl, char __user *argp) -{ - struct dma_buf *buf; - int info; - - if (copy_from_user(&info, argp, sizeof(info))) - return -EFAULT; - - buf = dma_buf_get(info); - if (IS_ERR_OR_NULL(buf)) - return -EINVAL; - /* - * one for the last get and other for the ALLOC_DMA_BUFF ioctl - */ - dma_buf_put(buf); - dma_buf_put(buf); - - return 0; -} - static int fastrpc_dmabuf_alloc(struct fastrpc_user *fl, char __user *argp) { struct fastrpc_alloc_dma_buf bp; @@ -1253,8 +1233,6 @@ static int fastrpc_dmabuf_alloc(struct fastrpc_user *fl, char __user *argp) return -EFAULT; } - get_dma_buf(buf->dmabuf); - return 0; } @@ -1322,9 +1300,6 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd, case FASTRPC_IOCTL_INIT_CREATE: err = fastrpc_init_create_process(fl, argp); break; - case FASTRPC_IOCTL_FREE_DMA_BUFF: - err = fastrpc_dmabuf_free(fl, argp); - break; case FASTRPC_IOCTL_ALLOC_DMA_BUFF: err = fastrpc_dmabuf_alloc(fl, argp); break;