From patchwork Tue May 13 04:28:21 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ekansh Gupta X-Patchwork-Id: 889675 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B170F1E32D5 for ; Tue, 13 May 2025 04:28:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110517; cv=none; b=Ro5r07sWbajDRP/Q2k3wA9zU+YohAvgn/YGGhBady+4STL0T7hCq8SyVohRweXGJN/3nCmRKFv71gMt4lkdo+bJJwschZaB93U40O1oDK2BG8Psk/VHAMSuLWD4xGvaOddzSDcR6eQqIIu4fY1jDEBlbRqTTndALg1VNkQCMBJA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110517; c=relaxed/simple; bh=lVZ470qAXY14EXPU6lTKjuSsb5rLHlyTi7oAECx0L/g=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ahbcvFyIOfLM5AhxvZ/le8mhP7fRYb+AMwmpsMI8n2ObaI761tU58+ILxAHrzYllQDeLAbrDEkxDdmYUxjDsSnIqZ6wBvCrOy84XkBkg266NmFsvcd3fsXifNJp83ft47ppSllGul239FG94zKpOWO3BTpZTqIMUPeHQcijCar0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=fyERwcWy; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="fyERwcWy" Received: from pps.filterd (m0279873.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54CIW1N3007509 for ; Tue, 13 May 2025 04:28:34 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=0Wt0GbBUNwU U3CBX0BKb99qSKLR+tWyMkIzj1AQsy0Q=; b=fyERwcWyxHKMuCu8oqpW3wonN4B 9+mQ1tI14fOldzaUEmrqzTsn2qabSdnVCBtrNDL39guRPjh1A4ITtTgUgAL+ABwP PgqyOhaIFsUqtGfXYti67R7U2TE6vQBxD6sG7Yio7cia/sdM1OeHggJUflYeTSWx 1h137inJP4oTVAolZ/yI29NrKreEXO5iXeQ4r+KIbPnDrzdhwGCh4u1SS6M/u+Cs q1GGJxfILQMmWFjzcKDmU3GQvEEQH7SkP6JCAvJg2xzJPA0HiuhgVdzB1pcTdnmV yWXZPup/XU5iMQWnqocsOQiDBVF0HuW7qF9GQODGv3JK65sIjllO8OuefNQ== Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 46hv5qeprf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 13 May 2025 04:28:34 +0000 (GMT) Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-b2085f3bf5cso3043166a12.1 for ; Mon, 12 May 2025 21:28:34 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747110513; x=1747715313; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=0Wt0GbBUNwUU3CBX0BKb99qSKLR+tWyMkIzj1AQsy0Q=; b=Py9SzlZTkbHP5s9cz+zmwJobPP+/gjOVMY5VzlGMqhPCe7O+JPLovTcfa5SPrAXh3S B4jtNiJ+V6pUlYKG6K8gtXCqE9KM//ZzNUw3S942X8FBE+M0tchfxv7NAiC52yX8cnsb BCDq447MEOTFv0tO3+vj/NAk8M/GvwN9aiTcBLg4zxq7FtIjTIW5TwEmka2Exjc0JcWw GWygng7eVsGNlJYJYzW+WUsQHMoGBeCkJiK8P8M7lwC65TP+P/a/mcnKL02Nwi6oi8Z9 Y28jrg4qbpkzO4VygCMVQXS+YBl6k1Kn2cfxIdD576VlvrJ7Ql/tMQVMOq1HtAhHqK0n mGFw== X-Forwarded-Encrypted: i=1; AJvYcCVw9APPE6/WUd0Up8c4Pzie5ZwS2YrRyzd1DQyl0EsrVwtzZAxkrPSlv/c87ZaNTB54TKiYSSm8WipGq4gL@vger.kernel.org X-Gm-Message-State: AOJu0Yx6LG1H9ckwCN0uG2nXjDbfDNU7ur26/arJB49SzP4nInGBNqel +Y7M45GedzJV55adT1hjHwKivRMdKtU6T1MepKuo69H4yOdnmuVVeA9DMPFYJUniDkO96zshYz2 wn4VgSl1qKKjY8YGQ2NEb7waWqx5uEmRtkDZmYvcMlodtJCny6p6lew37+mkPRZ4m X-Gm-Gg: ASbGncuILLMK+e4D8GdeLSdDEqP5ajoHLxyHJ8sQUMfchCk0kytisJSfv8bT4Isker3 jG5F6Es49cS/hMM4t417UlZHMai/bLodDqxrmqgi49/x4bQJ4y16QHRVmDqTlyXHqkPTbPhnPLJ IwbD+A1x9ONTyOCv9SPSk3camQKbGhZp6jwfG4LBdNfBTsxi0XWGFjmo/uNKfbIAoJjLuf6Aq0f 9ishY/mF+qe6VcO2KkFbHjnI/vGKG6DacwXdr7/z+9YVairLXcNYQVdgwMujJp4QXCzat3BxlXV aq3rVFPztG2E+22nQQiSYiJ+fdPwH/5c0yarOr1oyjNq X-Received: by 2002:a05:6a21:648c:b0:201:8a13:f392 with SMTP id adf61e73a8af0-215abb3a036mr22831428637.20.1747110513054; Mon, 12 May 2025 21:28:33 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHtAZDS57gaeo6+l2GKtDyxXJDhvCrMInic2QuKuXWsVSU5v5nDoqK57ZyLXWaJ0MLUYJUb+w== X-Received: by 2002:a05:6a21:648c:b0:201:8a13:f392 with SMTP id adf61e73a8af0-215abb3a036mr22831397637.20.1747110512674; Mon, 12 May 2025 21:28:32 -0700 (PDT) Received: from hu-ekangupt-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b234ad3e9f1sm5486101a12.35.2025.05.12.21.28.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 21:28:32 -0700 (PDT) From: Ekansh Gupta To: srinivas.kandagatla@oss.qualcomm.com, linux-arm-msm@vger.kernel.org Cc: gregkh@linuxfoundation.org, quic_bkumar@quicinc.com, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, dri-devel@lists.freedesktop.org, arnd@arndb.de, stable@kernel.org Subject: [PATCH v1 1/5] misc: fastrpc: Add NULL check to fastrpc_buf_free to prevent crash Date: Tue, 13 May 2025 09:58:21 +0530 Message-Id: <20250513042825.2147985-2-ekansh.gupta@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> References: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-arm-msm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Authority-Analysis: v=2.4 cv=DqtW+H/+ c=1 sm=1 tr=0 ts=6822ca72 cx=c_pps a=rz3CxIlbcmazkYymdCej/Q==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=y_gjuFtE12-Q3iuIhokA:9 a=bFCP_H2QrGi7Okbo017w:22 X-Proofpoint-ORIG-GUID: rTRT3qRSgBWrlilkDnuWN_v2TRbRA62u X-Proofpoint-GUID: rTRT3qRSgBWrlilkDnuWN_v2TRbRA62u X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDAzOSBTYWx0ZWRfX9fp1Awe/cba5 m4DtQlUgGh4bg/EVi22v0TZFsd2ZOjbe8TlCnxfpylZPjbDDDVt1qygiDbQY+ExdzEUo8Y5AEwi oklJ5jIkqPoIa1TeVFb7vZXCpQ2/aWYUa0mf0M1BoPxapMTSN3fA5StL3MlMZzKtpKDZXvI4QvH UE0/hBOqawTfAOrdZk2SwGhjwZhuPiAqB9jJYOSmfPWTeYSE9xaXjRo8+yUrm+c12errkSC1MPg gpxhnPsHnV18u7ewPXVOPeADDSMZkWu6kzHZlJ5p2TA8+7jKyGd1uF3tgN/LCdryVITAODfhzbP W2iwtJlr3SZHpAZNbNfo0Jg4b7cHRsZsc8Vxr6wRQveuzP8fRSvUd32k6MY2MyYfrgzzQ7Jabnc 0iCiZBBXu4jYTnnX8AZfkljt7Ne93+s/Vnqo5ZtDgSKsmcLYAAamEMtcqa1EYssasUJ00cU0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 bulkscore=0 phishscore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 impostorscore=0 spamscore=0 mlxlogscore=999 malwarescore=0 suspectscore=0 priorityscore=1501 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130039 The fastrpc_buf_free function currently does not handle the case where the input buffer pointer (buf) is NULL. This can lead to a null pointer dereference, causing a crash or undefined behavior when the function attempts to access members of the buf structure. Add a NULL check to ensure safe handling of NULL pointers and prevent potential crashes. Fixes: c68cfb718c8f9 ("misc: fastrpc: Add support for context Invoke method") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta --- drivers/misc/fastrpc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 7b7a22c91fe4..ca3721365ddc 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -394,6 +394,9 @@ static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd, static void fastrpc_buf_free(struct fastrpc_buf *buf) { + if (!buf) + return; + dma_free_coherent(buf->dev, buf->size, buf->virt, FASTRPC_PHYS(buf->phys)); kfree(buf); From patchwork Tue May 13 04:28:22 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ekansh Gupta X-Patchwork-Id: 890354 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 173A41E570D for ; Tue, 13 May 2025 04:28:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110521; cv=none; b=aSrcbT9Puh5q/wNyerUY0AxAGBRUrlhldITmVuLrGHtLvBctOtg+1zYz0FOLMITgzPPHqI0YnaTVJSDzc1A7LWfZIt9ztsIjGchBAffBDI96uhs/pIbfBVExqiQX3jgS/DZ6QQJaYz9bx/wWms5AnVwTY8Fw0mTtFUhVA8M5hpI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110521; c=relaxed/simple; bh=oWCR1gkWJ5Ozp3f18wS0ekIwbkaN21aXHvSV+DM+JQ4=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=dO0K41RSjqWnmuzrysGOA1Eh0uYw+jgnmjDaxRmiUXiRsNoi72+viSfMLx8aAno3SWOwtpBAniY147i6/tGFj91ATeb2demBAox+93FG78WOx0Mpsfi45rSIOXLrZtJIEg0WyvoHefiNN+jgz0uwVsyKSbZopzgzbIadG+bbob0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=Go2jo/RJ; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="Go2jo/RJ" Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54D3maKl023589 for ; Tue, 13 May 2025 04:28:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=JBKTYpKkO0p hGBWecSjnY+M4MAGQXCre+WzNfXWOMeU=; b=Go2jo/RJcASnyPTMxi28UiOJHE+ SC4BRR3zurlF4R8nyXhDKqzYuXg9nU4tvauuqyUD17R4FGIs8Nki9N6j1P6Tzo50 q3Z/ktRsskwiWu/Y3ImSGv+/RN5khHkZbETNcR8woFHOHV2YDHAIEuk4Gq+ulnkM mB8+1lLwxESyuB32jcVZMjUvL/uaWbm2l6do36inizGNaY5Z9AAI0H0nSQU70v+D 2+KekcmNq2gESWZvC11U2P/HE5BaihZ9TEkSlr+w3UPjByk7S+uVFQs5DZykXhHv fdXOYKVSKTIoa8oujTAAyGyBTGXtu9kFielc+cPZu0z3C6UvWdSAjxXXLng== Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 46kcfejweu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 13 May 2025 04:28:37 +0000 (GMT) Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-740b646ff9eso3780367b3a.2 for ; Mon, 12 May 2025 21:28:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747110516; x=1747715316; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JBKTYpKkO0phGBWecSjnY+M4MAGQXCre+WzNfXWOMeU=; b=Yf/I9GuPUHTT7SQ8jgDGNizgCfg0eO3tyA0bcYWUbZ/ceElKpZIBhKn9DSel1bePwg wHPnzjZSGAzT3e9aq5F5q2EOX5D/ps9ZMErCeMefHTV+5Huuhdw5+o143xj94vHA0hnw xKYRJ6wNRGZ5byw/Bzucgj2jSsk2RslPk/xR3iO3BMvh3jrtxoLc9sPtxgyT1atYZ/4i AD0GXDedW1DukZs8aa80ieBvdieJ2zlZqDrZ24xdZAQhU+UNWW7aBfRPIfjeqOpSuW1m 4S8eEcCp53EzcJOals6S892HwbeBGIF1SOspcm8IUYrUD64GHQBA5Yw6m866jPljNB57 /Cqw== X-Forwarded-Encrypted: i=1; AJvYcCUzL5InniuDPcze+txR04VYByNFMeg3qcSmqJ5PnMhYUujaHrmOLsFpiMreHYSKmvhjNgi44azZOF2h4Dy/@vger.kernel.org X-Gm-Message-State: AOJu0Yx/EJ3pbTaeRpKOlwlh4TDVJXxK/XWSkF62DxQNQdSaY7Iwz++u iAT4l2Fb2J4AkYna+9NMRAtOO4c2+iyyVwtrodCl/tOSz7ov8fjoM/bcmbSqk5fIgwvr6Xi/1Ga E/3L3tyIbCWDRToVQgn2ZH5UA+IMxi9bfXbLkGJIH+B2L4+aGMoSE/Wu3ODLfEU+2 X-Gm-Gg: ASbGncum8y5FHRAKnY1Tg5RoMMuCN0ShBhE7ZBZjA+dXFVW1JXyedLNCRWCCI/fSTq/ wmQzJMPZUp2yq+8WHf7DUKz1lpirJDIhKGCzqshUTCUa2/3kWgWwCjVL0eHnAM0vptFVkfovzZO AjJP2KR1fxzuv9UgRnioaAKy55sH9pQxoMGxX59A4l6QTUckGbb4/A5PFzQyExAyfzpOaFvxXjF GW6FjOCHcD4Cz9ItxV9wZM5T66+s8mkOwC5ZwqL9TbcbzAIau61AFMbknd5wQh3+1loUqmokSA7 QAkrJyA9DBUvpJJnxtYAI7oAZHfp9Rucw6VQlm+VIRqo X-Received: by 2002:a05:6a21:329f:b0:215:df62:7d51 with SMTP id adf61e73a8af0-215df628053mr5732965637.11.1747110516373; Mon, 12 May 2025 21:28:36 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGj8cGPKXqDpWef9yIeurebhtNZT+H7Bmo9NepDU0xQBRo7bKnmIjazNK/c1Ygs924EivHqHQ== X-Received: by 2002:a05:6a21:329f:b0:215:df62:7d51 with SMTP id adf61e73a8af0-215df628053mr5732941637.11.1747110515935; Mon, 12 May 2025 21:28:35 -0700 (PDT) Received: from hu-ekangupt-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b234ad3e9f1sm5486101a12.35.2025.05.12.21.28.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 21:28:35 -0700 (PDT) From: Ekansh Gupta To: srinivas.kandagatla@oss.qualcomm.com, linux-arm-msm@vger.kernel.org Cc: gregkh@linuxfoundation.org, quic_bkumar@quicinc.com, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, dri-devel@lists.freedesktop.org, arnd@arndb.de, stable@kernel.org Subject: [PATCH v1 2/5] misc: fastrpc: Move all remote heap allocations to a new list Date: Tue, 13 May 2025 09:58:22 +0530 Message-Id: <20250513042825.2147985-3-ekansh.gupta@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> References: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-arm-msm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDAzOSBTYWx0ZWRfX9ycMLbjOdWrw PQI2Ymak4vHeDs4qLwCdeTBu0W1igMzMJAz1s5BaU3o16JeLVxSR7E3y9oZB/QaBq+0ceD9D3G2 AQ8jLPcLgq+pS4vSYZiRpubIKDrB62lREWp09xljRuTpka7V/dr3a/YNxwyBoysccT0ohxBOI3r L3h3/eudGuAwWDTq+r22LQiZx3kka7CjwkKg/4nXxwSEWFnD69HB/sSQNLtxET9i4u4dPlSrLdc uIPbvmGrfZ6PalNqHKToK1rE6FPJ6owOj5cOdCtU/sOxGV0jB0xVHtnkgLSfujoecylDO4eiqt9 K6uZUgO5hpl/x/kMzUtBiDdq4nkuZcQqH50Hi86Qx5AeilYWDosoSAhZv4Cv/8HyPyLEkVqyz+D WsZq07w5PBcd95JSqoY5KCiWjAW4YB9BtrhqkvN12sw1CTivneA/4IUAUuGuwSKKJd+dt1dC X-Proofpoint-ORIG-GUID: UA2R96B3xN2RUfGbhjNuFOjhlouu1DkI X-Authority-Analysis: v=2.4 cv=asuyCTZV c=1 sm=1 tr=0 ts=6822ca75 cx=c_pps a=rEQLjTOiSrHUhVqRoksmgQ==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=8PHFzVjbKYy-BIK1PrEA:9 a=2VI0MkxyNR6bbpdq8BZq:22 X-Proofpoint-GUID: UA2R96B3xN2RUfGbhjNuFOjhlouu1DkI X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 mlxscore=0 impostorscore=0 malwarescore=0 mlxlogscore=999 adultscore=0 phishscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 lowpriorityscore=0 spamscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130039 Remote heap allocations are not organized in a maintainable manner, leading to potential issues with memory management. As the remote heap allocations are maintained in fl mmaps list, the allocations will go away if the audio daemon process is killed but there are chances that audio PD might still be using the memory. Move all remote heap allocations to a dedicated list where the entries are cleaned only for user requests and subsystem shutdown. Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta --- drivers/misc/fastrpc.c | 93 ++++++++++++++++++++++++++++++++---------- 1 file changed, 72 insertions(+), 21 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index ca3721365ddc..d4e38b5e5e6c 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -273,10 +273,12 @@ struct fastrpc_channel_ctx { struct kref refcount; /* Flag if dsp attributes are cached */ bool valid_attributes; + /* Flag if audio PD init mem was allocated */ + bool audio_init_mem; u32 dsp_attributes[FASTRPC_MAX_DSP_ATTRIBUTES]; struct fastrpc_device *secure_fdevice; struct fastrpc_device *fdevice; - struct fastrpc_buf *remote_heap; + struct list_head rhmaps; struct list_head invoke_interrupted_mmaps; bool secure; bool unsigned_support; @@ -1237,12 +1239,47 @@ static bool is_session_rejected(struct fastrpc_user *fl, bool unsigned_pd_reques return false; } +static void fastrpc_cleanup_rhmaps(struct fastrpc_channel_ctx *cctx) +{ + struct fastrpc_buf *buf, *b; + struct list_head temp_list; + int err; + unsigned long flags; + + INIT_LIST_HEAD(&temp_list); + + spin_lock_irqsave(&cctx->lock, flags); + list_splice_init(&cctx->rhmaps, &temp_list); + spin_unlock_irqrestore(&cctx->lock, flags); + + list_for_each_entry_safe(buf, b, &temp_list, node) { + if (cctx->vmcount) { + u64 src_perms = 0; + struct qcom_scm_vmperm dst_perms; + u32 i; + + for (i = 0; i < cctx->vmcount; i++) + src_perms |= BIT(cctx->vmperms[i].vmid); + + dst_perms.vmid = QCOM_SCM_VMID_HLOS; + dst_perms.perm = QCOM_SCM_PERM_RWX; + err = qcom_scm_assign_mem(buf->phys, (u64)buf->size, + &src_perms, &dst_perms, 1); + if (err) + continue; + } + fastrpc_buf_free(buf); + } +} + static int fastrpc_init_create_static_process(struct fastrpc_user *fl, char __user *argp) { struct fastrpc_init_create_static init; struct fastrpc_invoke_args *args; struct fastrpc_phy_page pages[1]; + struct fastrpc_buf *buf = NULL; + u64 phys = 0, size = 0; char *name; int err; bool scm_done = false; @@ -1252,6 +1289,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, u32 pageslen; } inbuf; u32 sc; + unsigned long flags; args = kcalloc(FASTRPC_CREATE_STATIC_PROCESS_NARGS, sizeof(*args), GFP_KERNEL); if (!args) @@ -1273,26 +1311,30 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, goto err; } - if (!fl->cctx->remote_heap) { + if (!fl->cctx->audio_init_mem) { err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, - &fl->cctx->remote_heap); + &buf); if (err) goto err_name; + phys = buf->phys; + size = buf->size; /* Map if we have any heap VMIDs associated with this ADSP Static Process. */ if (fl->cctx->vmcount) { u64 src_perms = BIT(QCOM_SCM_VMID_HLOS); - err = qcom_scm_assign_mem(fl->cctx->remote_heap->phys, - (u64)fl->cctx->remote_heap->size, - &src_perms, - fl->cctx->vmperms, fl->cctx->vmcount); + err = qcom_scm_assign_mem(phys, size, &src_perms, + fl->cctx->vmperms, fl->cctx->vmcount); if (err) { dev_err(fl->sctx->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d\n", - fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err); + phys, size, err); goto err_map; } scm_done = true; + spin_lock_irqsave(&fl->cctx->lock, flags); + list_add_tail(&buf->node, &fl->cctx->rhmaps); + spin_unlock_irqrestore(&fl->cctx->lock, flags); + fl->cctx->audio_init_mem = true; } } @@ -1309,8 +1351,8 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, args[1].length = inbuf.namelen; args[1].fd = -1; - pages[0].addr = fl->cctx->remote_heap->phys; - pages[0].size = fl->cctx->remote_heap->size; + pages[0].addr = phys; + pages[0].size = size; args[2].ptr = (u64)(uintptr_t) pages; args[2].length = sizeof(*pages); @@ -1328,6 +1370,11 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, return 0; err_invoke: + if (buf) { + spin_lock_irqsave(&fl->cctx->lock, flags); + list_del(&buf->node); + spin_unlock_irqrestore(&fl->cctx->lock, flags); + } if (fl->cctx->vmcount && scm_done) { u64 src_perms = 0; struct qcom_scm_vmperm dst_perms; @@ -1338,15 +1385,15 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, dst_perms.vmid = QCOM_SCM_VMID_HLOS; dst_perms.perm = QCOM_SCM_PERM_RWX; - err = qcom_scm_assign_mem(fl->cctx->remote_heap->phys, - (u64)fl->cctx->remote_heap->size, - &src_perms, &dst_perms, 1); + err = qcom_scm_assign_mem(phys, size, &src_perms, + &dst_perms, 1); if (err) dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n", - fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err); + phys, size, err); } err_map: - fastrpc_buf_free(fl->cctx->remote_heap); + fl->cctx->audio_init_mem = false; + fastrpc_buf_free(buf); err_name: kfree(name); err: @@ -1869,6 +1916,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) struct device *dev = fl->sctx->dev; int err; u32 sc; + unsigned long flags; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1937,12 +1985,15 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) buf->phys, buf->size, err); goto err_assign; } + spin_lock_irqsave(&fl->cctx->lock, flags); + list_add_tail(&buf->node, &fl->cctx->rhmaps); + spin_unlock_irqrestore(&fl->cctx->lock, flags); + } else { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); } - spin_lock(&fl->lock); - list_add_tail(&buf->node, &fl->mmaps); - spin_unlock(&fl->lock); - if (copy_to_user((void __user *)argp, &req, sizeof(req))) { err = -EFAULT; goto err_assign; @@ -2362,6 +2413,7 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) rdev->dma_mask = &data->dma_mask; dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32)); INIT_LIST_HEAD(&data->users); + INIT_LIST_HEAD(&data->rhmaps); INIT_LIST_HEAD(&data->invoke_interrupted_mmaps); spin_lock_init(&data->lock); idr_init(&data->ctx_idr); @@ -2420,8 +2472,7 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node) list_del(&buf->node); - if (cctx->remote_heap) - fastrpc_buf_free(cctx->remote_heap); + fastrpc_cleanup_rhmaps(cctx); of_platform_depopulate(&rpdev->dev); From patchwork Tue May 13 04:28:23 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ekansh Gupta X-Patchwork-Id: 889674 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7D641E0489 for ; Tue, 13 May 2025 04:28:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110524; cv=none; b=GIBnjpYHYJVIq6+rsoFTCmfEDMygkwhQ40zbG/pKrwxkLRtKeSgqcY/H2N3l2xzgo76uMFrkFirNPpc9yhHaKV1NPf908MXQPSF9xGmFb8a+9byf/+siczPw3zNIiuKJ7PmJKLBdkvq84lLvmKWtSHO+Ipc6McjuMTr6hAk/B0A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110524; c=relaxed/simple; bh=ZqxErHXIh7dPrWcetdQxxPBTtJ2e+XLBRN9zKxPHcDQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=CNUF0IEXn5hmypc7YLgFdq+kaZiWvuV6hUjmdrECdL0KjIDgilIxF02OcQvrKyK870M+n8LGQnG7QgX7U5duTasSiIPRg41xR7Ki5iZjijuSS20HVzYr7wGRf8OG8srSsVaR2Bpp/yH1aqDqKUUoy6++R04/iQUPmFt6H80AK3w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=eBy3rIC2; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="eBy3rIC2" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54CJh1x3015839 for ; Tue, 13 May 2025 04:28:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=80VSBrnaMRJ WWQG6HQKfwi1RurptGFsnclEszCS2EMo=; b=eBy3rIC2NAX96Zdk7fuJsOzUt85 6ifwrIy5+rpygd58PYr8tVmvWfS+Cpto09Uu/Sa1OU0/7jmYM1pcq5wkupMT+m5r Mh9aVUVXLCqTvmM8k+IVIDE1m6IUqhf9PTw8mwsihps3kPnlMrNOvp1mauVIPkYx JlLFxJaYTb0GWnVc9vpOak5iCMQtb7Ldkg9HV8ctBlFqfkZ3Z7a/i8vf9uxhqnso 6L3AGbHGk+lmwHU+nqNwsqKkgccFH1XnUUsh1ZEg1RrAOmuROOZQX5rfcADN7t70 XMiF6GDxx6KPYMoos1wLT8y1Kw8MznrGSxTmwOWP7U9YAHn8jS7ePRCqWsA== Received: from mail-pg1-f198.google.com (mail-pg1-f198.google.com [209.85.215.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 46hx4k6e44-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 13 May 2025 04:28:41 +0000 (GMT) Received: by mail-pg1-f198.google.com with SMTP id 41be03b00d2f7-b23d12e14bdso3954964a12.1 for ; Mon, 12 May 2025 21:28:41 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747110519; x=1747715319; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=80VSBrnaMRJWWQG6HQKfwi1RurptGFsnclEszCS2EMo=; b=aDv9Tl/Km01zzuTt6PRMlJOzFNHnIYIS2pmsC6146TY7rgA+0rbZ1+TSbtZjBAxadx PXTHDOtGQLTkTW7JCNjdOYB51t5RqrN20ZDLPG24J7GIOwyBgMMDiF2QaS/9/ZlWrn/V teApQZE5b9V0rZ0JvYsN2meixdFeu+ufD+N50nHU+R+nsBscYpue94HOzFpVjdFG5fxi qlYDP1hQC+IAsQKHym6BdPnjj7kF8mdGXGR3M72TK5r8SYSCAErS7sU1iTn50osxXdIL rqDDgySJcyZcFm1v7uOd2TuKwtw1KGe2D9pdPh1VhEQ4Bg7IE9BulBzLyMMpglA7fZQe Gj6g== X-Forwarded-Encrypted: i=1; AJvYcCUCFX/3wUu5DV1hIuVWki2D6YYba3Urhz2cF3j85O1G/rmDD8wP1Uru3BXL1p1TwPcSqa1LeD0yGtcTCRSz@vger.kernel.org X-Gm-Message-State: AOJu0YzPwDzRas8v2BLjes0T78VAyGsvGs6wR9+bhW10i0JYztn3NSa3 /nwpY5L8fquORjQubDiCrC7RRxkOwll+amXXiQvOSJ938BD2/YKz/CCMSDf0790T7llHZBC+Azv jwJFvg+uPF42wICgcjMmSzmSZWxD93ADhJB9kFXAjOO5bw/zBnJ/PY33QOu8pGD2wAKg44uas X-Gm-Gg: ASbGncsLE3kAoqaYnYG6odaDLGiwKAnI7BRJAxf15zb8EhCeF17eJ3bMKndRnqQdOuz Tfagq7bpMVNPjaImlg7o78Crd/bbeC7o+Xavt/+4qqYh+cCzpfougYk5873Nd476Pg4EAmxgAbj aI7gb9B0CpgryPy5c/aPe6n1eLbGBq/t9hnqYjzFBY1ZFyI/qB1IcBQsdrQFFU1b2Kvqpja23uM EgIwciQ7WnKozjemVM3bvA5tgZMl/QJ7BFpfqc9PD6lzNuNZkOr8X0Sl3+GBAD46sHRfCOrj0Ls r3m54uNVo/3U7EMxwJSVobFqBQ0yIiOthyug5mzsH2dj X-Received: by 2002:a05:6a21:458b:b0:1f5:70d8:6a98 with SMTP id adf61e73a8af0-215ab883667mr25224175637.0.1747110519625; Mon, 12 May 2025 21:28:39 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEkhTKa1aIjIDArtHetshGQTFyREicJBCEr0fG8qbpWn0Htg+JAbubSWvVsCfvyg9O9E3J4Ww== X-Received: by 2002:a05:6a21:458b:b0:1f5:70d8:6a98 with SMTP id adf61e73a8af0-215ab883667mr25224141637.0.1747110519205; Mon, 12 May 2025 21:28:39 -0700 (PDT) Received: from hu-ekangupt-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b234ad3e9f1sm5486101a12.35.2025.05.12.21.28.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 21:28:38 -0700 (PDT) From: Ekansh Gupta To: srinivas.kandagatla@oss.qualcomm.com, linux-arm-msm@vger.kernel.org Cc: gregkh@linuxfoundation.org, quic_bkumar@quicinc.com, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, dri-devel@lists.freedesktop.org, arnd@arndb.de, stable@kernel.org Subject: [PATCH v1 3/5] misc: fastrpc: Fix initial memory allocation for Audio PD memory pool Date: Tue, 13 May 2025 09:58:23 +0530 Message-Id: <20250513042825.2147985-4-ekansh.gupta@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> References: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-arm-msm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Authority-Analysis: v=2.4 cv=ReqQC0tv c=1 sm=1 tr=0 ts=6822ca79 cx=c_pps a=Qgeoaf8Lrialg5Z894R3/Q==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=l_23c2mIThvE2ntJpuUA:9 a=x9snwWr2DeNwDh03kgHS:22 X-Proofpoint-GUID: f3A8tyYZ2esaM1kGceqBL3xfvi1rk3fc X-Proofpoint-ORIG-GUID: f3A8tyYZ2esaM1kGceqBL3xfvi1rk3fc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDAzOSBTYWx0ZWRfX5bgjRDw7Rocy OnX/llVvE80y3Juy5Uzzk8QepX729NibX5wPsCMj/0zm91uDdSoqZqHQCMhn48FbApDbsHO4huH eHe8T1r4b7LB3OYGrcCSPtuu+3oOkgzk3yeYWdt7sVegjMCPA1qLeTLl1I/tor+B+ubQc3nr2uQ xYMRNWpYs00l2Fd8KN5oOZ0zzG6MeSfB7cP66zC8rv3WUezraC6BNeIDvgRZb3p2FA2aGL5VZj9 JJ73ICzYpPIh5VGlZ+3OFD0ZvuZILnouZxfTcEdJpSUEjUbCv3FhWcFGyV/gdLJaxzAfHUByIS0 esafB/8aj4AfzDil3L6EprE/xiuCDOQZqLVYMQMpnvEb0xoTb90qCyzKYtr9Xs31Nx2V6Izx6El pwi0W5XGO0F53bcoiRBujRrD5IRmj19pZlXdZvBBQQrGfzSZl8fytPmNkX7Gw4el4utHByyu X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 mlxscore=0 mlxlogscore=999 phishscore=0 suspectscore=0 spamscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 clxscore=1015 adultscore=0 malwarescore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130039 The initially allocated memory is not properly included in the pool, leading to potential issues with memory management. Set the number of pages to one to ensure that the initially allocated memory is correctly added to the Audio PD memory pool. Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta --- drivers/misc/fastrpc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index d4e38b5e5e6c..b629e24f00bc 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1311,6 +1311,9 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, goto err; } + inbuf.client_id = fl->client_id; + inbuf.namelen = init.namelen; + inbuf.pageslen = 0; if (!fl->cctx->audio_init_mem) { err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, &buf); @@ -1335,12 +1338,10 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, list_add_tail(&buf->node, &fl->cctx->rhmaps); spin_unlock_irqrestore(&fl->cctx->lock, flags); fl->cctx->audio_init_mem = true; + inbuf.pageslen = 1; } } - inbuf.client_id = fl->client_id; - inbuf.namelen = init.namelen; - inbuf.pageslen = 0; fl->pd = USER_PD; args[0].ptr = (u64)(uintptr_t)&inbuf; From patchwork Tue May 13 04:28:24 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ekansh Gupta X-Patchwork-Id: 890353 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 677B01E6DC5 for ; Tue, 13 May 2025 04:28:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110527; cv=none; b=g7q0ormFYUaDVEUjOYHDRA0v0kjXswk43HDs0kbcl6WL/nF3g+IsKnCsnuQi8wAr+P68u/ROfSZmHx3w2Z4IMHbmQD5M2NpmMzLw6BNeBENtSXBFt+BUkjx9slAa8n4hjDDMDwyfRR3IzEaACs4FPHG0gA0tRiv4kuZov8eRwSk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110527; c=relaxed/simple; bh=219mGIdybJeDtz8GQAmZgDg/UcfEorRh98P57NlV1zE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=b3g0DUfrf38XmD6jdmlBau1yLLqE0m5oF+WxB8Qhkzhz35pSv4JSO4399JlDPZoY6sUwJKJwWy8jpNIW3JGLT1H1Tkphfs/pxDmniStRHUD1xs7FpxtHI1XRu0JHtZP42Rd2JNxZyLdIaN7Wk+tOvHBNltJIeWGG2nMPlLcaSdk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=LycLwXlt; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="LycLwXlt" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54CJgc0K021449 for ; Tue, 13 May 2025 04:28:44 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=W6GAILZe1jq 2FdYPLrjjokTUXGgsX3z5BCNlHC9cgZU=; b=LycLwXlt7RoCmNdFiYWyOvk/9/U hkFK/hXQ+w36NMnBW3d1QMc26PrmtSz01Eey4sN5jZck4qRvLu8ECoUcUPqRJRMI itULNwyPdkLVrwgLJFGSVnl/gBq8LqGFzNbb8MfBA0jIKwEDFYF3IcOc9ucy0T9f AOw8Oo/uD+/5oELDmC1uXN4dPv5J2YSt6pgiO/4HCssP6u4mnbFzEws1XveLyws3 gwDICGWS9pFhp/fzoXF2+/kTyVbp+1P3qnJ4ug58T+5gPnQbF0c4Oit9EtgJSvlr T4KPg/kklSbM2wBgJ3ktk9Ku2twY+EoQZpktb5V8Dld+NXx0l5henjbXuow== Received: from mail-pg1-f198.google.com (mail-pg1-f198.google.com [209.85.215.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 46hx4k6e49-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 13 May 2025 04:28:44 +0000 (GMT) Received: by mail-pg1-f198.google.com with SMTP id 41be03b00d2f7-b16b35ea570so5222304a12.0 for ; Mon, 12 May 2025 21:28:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747110523; x=1747715323; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=W6GAILZe1jq2FdYPLrjjokTUXGgsX3z5BCNlHC9cgZU=; b=w9KWLMDKUrDFROoSPgJpEVxd53DSrrBkk2ml9MvNNmuzccUwEmF7W6U5gXlN4ZlXSZ 0AbYGq1GWDNTaaD1hEIijl6I53AzX3tfnFMJfrFPPggoGNtb3Khp6ZyFz9ls9Uk1kNBq +TtBm6pR+z4nsN0trklNpcArc8/Ll7u+8hEw+RQr8IrsGPpZjMr+ZkLEZv0MlykrY+wy Q6IgzwIbBvabK3eurd/hQmjboYXpPLNAQj/hqqcIN+dNrWyn/G5M/k6aHz664wkhVtoh Lb2JyAYZfdFbmH2dg77fpEYq3L1tN31ww224iK+J2yeIeqf5IgxaMSkKektMq7uPHb4t 3rZg== X-Forwarded-Encrypted: i=1; AJvYcCW1n7e/H5O8Ynstsq3Ftt2YmTWUtWf+1l7wk9Qya9OgA1bd79s2qOKKIno4W4231vAEKJ636EXuoXsHtFD5@vger.kernel.org X-Gm-Message-State: AOJu0YyaeFLNjvWW7tGsd3UcEvZ/7VJcquv5t/kOS62m+/CI6vPsb4H0 RuZzZB0+lY1NO3I52PiDmrueuPhLL9sy7L/E6rkGt7qv7hjkwSh2a9YOPB4h/z7Hr1VggM99sx8 IhHTbO3IbaYC1UHMLWlBjhc4g/volJJRtrFOnBU5atq0leXQe45R8D4l9pDwq63+/o2zhyE7x X-Gm-Gg: ASbGncvr6JHWAzp4L4Ea02n3eZ9psMx+wt8y7aqEuC8n45jS5JN5oPkltSubBL8feya SMP0rtK8Adg0O+toU2qEXtQrEaqMH1o6vSM4LyMLwjRpmxDO8tJYL1+z/GDryFTaSP/AwWMadqd js02QAakfT0OhhrkpgEUg8VTXwDwqabYkQWbsp/VsEFZcybjUxfbzJBRPi7GWDerG+f0wpcB3ok yqJfk3hvgrUCHIHgoglfAAkMX0qGPnaK7rdrTeT78svCPKwCKvCNi3WaS98PZTGQQB5wA8lx1GC dus3g0qgzGVEEL9S+uKrmjUaPvViA1JOyQMf7QUI1tNi X-Received: by 2002:a05:6a20:1124:b0:215:d565:3026 with SMTP id adf61e73a8af0-215d5653229mr6842192637.20.1747110522846; Mon, 12 May 2025 21:28:42 -0700 (PDT) X-Google-Smtp-Source: AGHT+IH4+gbSS6s7qSuU5YmGTKTsPTB3m3lJGYEwqEPy9irPtLLKsH0Ru/ril7XSm2s95m5IamjdpQ== X-Received: by 2002:a05:6a20:1124:b0:215:d565:3026 with SMTP id adf61e73a8af0-215d5653229mr6842165637.20.1747110522505; Mon, 12 May 2025 21:28:42 -0700 (PDT) Received: from hu-ekangupt-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b234ad3e9f1sm5486101a12.35.2025.05.12.21.28.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 21:28:42 -0700 (PDT) From: Ekansh Gupta To: srinivas.kandagatla@oss.qualcomm.com, linux-arm-msm@vger.kernel.org Cc: gregkh@linuxfoundation.org, quic_bkumar@quicinc.com, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, dri-devel@lists.freedesktop.org, arnd@arndb.de, stable@kernel.org Subject: [PATCH v1 4/5] misc: fastrpc: Remove buffer from list prior to unmap operation Date: Tue, 13 May 2025 09:58:24 +0530 Message-Id: <20250513042825.2147985-5-ekansh.gupta@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> References: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-arm-msm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Authority-Analysis: v=2.4 cv=ReqQC0tv c=1 sm=1 tr=0 ts=6822ca7c cx=c_pps a=Qgeoaf8Lrialg5Z894R3/Q==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=BnVeGx0dmUjw97O46OEA:9 a=x9snwWr2DeNwDh03kgHS:22 X-Proofpoint-GUID: SkCIfcdRj1b5T8Z_jbXDnS2ChUgva6N1 X-Proofpoint-ORIG-GUID: SkCIfcdRj1b5T8Z_jbXDnS2ChUgva6N1 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDAzOSBTYWx0ZWRfX7l4Xn9tqhHJ6 fbDt+itukbBsGdyG6cDpzi0Aa444MRoed3cLlCNpBH5bRujc3U4wh6HVszW90RKMqXl6+mDTIR5 IUBktQznFA02w/MtvWd24Mgwrw0h0pIXsfMUEMY/YzYsnP+ufCjFJy+2++Q79CzRPJTE0+yK1cq aIzwTQRBK4HGrZzHcCHh0KnHAxuYEwGaF20meJCbs/OTBW2mHB1B+jaKzJdnXNjAunDq/Q4rLfD p6GUN/UHBySPZYme3fLkMBkNL0/ISO111rTJHFbK+2RjJfKH/P/6AqKxHLeiS0YbzWhSoSnFb7n ZTj3LxkDNL0AoxplpHWOTKe7BTrpVMs+lCNaF0nkKBrDvfrM0rKZU/Lmc+xlIRT1pBK5Ke93HVr TCOLo5SiiP55D8e71qwbalrRh5/idmqH9LONIICi5m+c+SCfydjOVmTYqAvog33U+PcGfoiY X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 mlxscore=0 mlxlogscore=999 phishscore=0 suspectscore=0 spamscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 clxscore=1015 adultscore=0 malwarescore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130039 fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if any other thread removes the entry from list while unmap operation is ongoing. Remove the entry before calling unmap operation. Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta --- drivers/misc/fastrpc.c | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index b629e24f00bc..d54368bf8c5c 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1868,9 +1868,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_buf * &args[0]); if (!err) { dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); - spin_lock(&fl->lock); - list_del(&buf->node); - spin_unlock(&fl->lock); fastrpc_buf_free(buf); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); @@ -1884,13 +1881,15 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) struct fastrpc_buf *buf = NULL, *iter, *b; struct fastrpc_req_munmap req; struct device *dev = fl->sctx->dev; + int err; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; spin_lock(&fl->lock); list_for_each_entry_safe(iter, b, &fl->mmaps, node) { - if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) { + if (iter->raddr == req.vaddrout && iter->size == req.size) { + list_del(&iter->node); buf = iter; break; } @@ -1903,7 +1902,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) return -EINVAL; } - return fastrpc_req_munmap_impl(fl, buf); + err = fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); + } + + return err; } static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) @@ -1997,14 +2003,23 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) if (copy_to_user((void __user *)argp, &req, sizeof(req))) { err = -EFAULT; - goto err_assign; + goto err_copy; } dev_dbg(dev, "mmap\t\tpt 0x%09lx OK [len 0x%08llx]\n", buf->raddr, buf->size); return 0; - +err_copy: + if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR) { + spin_lock_irqsave(&fl->cctx->lock, flags); + list_del(&buf->node); + spin_unlock_irqrestore(&fl->cctx->lock, flags); + } else { + spin_lock(&fl->lock); + list_del(&buf->node); + spin_unlock(&fl->lock); + } err_assign: fastrpc_req_munmap_impl(fl, buf); From patchwork Tue May 13 04:28:25 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ekansh Gupta X-Patchwork-Id: 889673 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C47EA1E47BA for ; Tue, 13 May 2025 04:28:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110530; cv=none; b=kiriE0mh6Re5iPIy49rf7BA32EMvX+lH4IBh8R+J3nbmtBjD/VPLyNh0QV4n2OW2FCSFur38R+nLR9fnj9qJ5aFB5PRz0sejQEuFuXz69/4PM1+heB795FEgTUBhofFN0GFPV4mWro7gNPtIWqs3joVtbyVxqqG6nABfMpS2qbE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747110530; c=relaxed/simple; bh=b/jdrld+JHj+dMZXOOpKT68s1sxFCgElAgmgr19swG8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=oyo3DburuN3JnJJwSlHZXYzmWNkaA3bl4mKkqrDX51qpV42SobO0MYTEnJLqHD2srn83/6D/0EG4qHDz4cmec/u8F4rEXEN6oqj962jMjn9n039I+N9WGnGqMTJj4Tg25jc6VY1wGifol0Nb76D14vlwdolnD1MDUnyQikVjRJg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=clTGICtS; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="clTGICtS" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54CHEqNx022673 for ; Tue, 13 May 2025 04:28:48 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=qholBjkmu03 FdHRvMAFEHiCnlryUcq+WCE0WsE9Lw7w=; b=clTGICtSj2YYasarQEdnigsEtQN 1UT8M62U46N245c09+C/51ctES6Tg3128eZijR98FSW6063mS6gmg3vWCExn5jA1 HxHOEDjuuM+RpI73EOuZ5Jbkessxk/V197ZAxaaimVcSSnHcgRyVPrQjuPzEbc6d FkihbXrK7v4FwHkFrFBrJwSlDbJZMCA7v2qih512O8V318lh3vOp5OGriOtC3/vE OA4OJsaUAktMv4vKFFcfk2bGiNSAbWqRC/KU2vKKDWyWq25hA8DuWsA0L8PMsilp 36TYkTHCsHglJrnm037fNcxKru69Pz2enzw936vvkW3gl/WVLeYMHtsubyA== Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 46kdsp2m9v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 13 May 2025 04:28:47 +0000 (GMT) Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-30c9b0aa4ccso1952574a91.3 for ; Mon, 12 May 2025 21:28:47 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747110526; x=1747715326; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=qholBjkmu03FdHRvMAFEHiCnlryUcq+WCE0WsE9Lw7w=; b=odf7WNlwKlElztgCirKzHPwPOrONdGSdgfQM5bJFjj2otwAJwq2qFn7gl1Sg1+iyl4 LQdvPsCqAoRojjy4IR69SpROiZjW0aB0ix7rR5odoG45xGAzJ+YW4G2oEIXrbumUkS+Z jY9A0LsD30a+DtgOsvM1F952eDLGJNj6u6bMm7dN0mOROZWwihZj9trKiED03RCZdv+2 kgTNRB4QzfmzNdnB8LFjuxMUnjt5bV4JUIqM5G7/eNUKg4mwRRGE8oD5swm6xKHqp+FI GninCqg8iRHghxqD9j/aKETcrrmq4yuZwqbbmrNLv+D3N/8EX1OppN+JD4rqzAVzHG0d OJxA== X-Forwarded-Encrypted: i=1; AJvYcCV+cE9iTaYz0VpEXF8NDV7KCNu/sxYKga6SFjlKXQ54SGwb+XYyyuZnQ/NQY7hhtDqfMQpZRZmHf9x0iCYv@vger.kernel.org X-Gm-Message-State: AOJu0YwKYtjRjJ2siDtmHCMkGsHDkl/ESPCbPmp0sIxFqYWl9sqSRT9j 9hp8AiB2yTmHzUeVcIEXyk9AKv3dxN0k+gUzFP6C7AZaX3jK11qi3a7FSS2/tY6nTlDuC80gLnO lzyVOQ8ffkFzmyGic/62LvnPikIzLOMggMaProUoSTwR6QM1PiZ43/i8v3Fx5gJ6P X-Gm-Gg: ASbGncvBpfHHubrPgtkgP65bXd/UopwPRck7Oa1SNjxu/CVXBrun7kxNTeY5gh+JfAC jEzatxN/aZY9wOAKW+/6rMV9UwxABc4eec5uuJoDns+duhEoDByOJxXLa4cR2peVmtPJuOkZMAf LA7eB8jU7ATOi4yNkhy/LlsLtRjMbqcHrIFmnabLVHBDe/0FjgUNLsXoTFzIo012dVW3UjGct0v /d1nbzISVuOvlTYF8EGIr/gUj40/69IXsdoQ8rJ9qnY5xquHNDq0w7RHyeo0f3Gh/k/RpmOSIbm wzvs5yDBaPUnKe6gHTFMHRaP1LEdfdc1axlBQ36TbcGD X-Received: by 2002:a17:90b:4b4b:b0:308:6d7a:5d30 with SMTP id 98e67ed59e1d1-30c3d3e0a86mr27034336a91.18.1747110526294; Mon, 12 May 2025 21:28:46 -0700 (PDT) X-Google-Smtp-Source: AGHT+IF6dBAWDLUjqJ4kvsD4zVoy0B09Mb6RcQq2ArhYi6gGrcPHxd8tFxTtMMDWjf6AjNgGa2lz2Q== X-Received: by 2002:a17:90b:4b4b:b0:308:6d7a:5d30 with SMTP id 98e67ed59e1d1-30c3d3e0a86mr27034300a91.18.1747110525743; Mon, 12 May 2025 21:28:45 -0700 (PDT) Received: from hu-ekangupt-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b234ad3e9f1sm5486101a12.35.2025.05.12.21.28.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 May 2025 21:28:45 -0700 (PDT) From: Ekansh Gupta To: srinivas.kandagatla@oss.qualcomm.com, linux-arm-msm@vger.kernel.org Cc: gregkh@linuxfoundation.org, quic_bkumar@quicinc.com, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, dri-devel@lists.freedesktop.org, arnd@arndb.de, stable@kernel.org Subject: [PATCH v1 5/5] misc: fastrpc: Add missing unmapping user-requested remote heap Date: Tue, 13 May 2025 09:58:25 +0530 Message-Id: <20250513042825.2147985-6-ekansh.gupta@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> References: <20250513042825.2147985-1-ekansh.gupta@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-arm-msm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Proofpoint-GUID: 44LBxmetKwHoBhK2GMZt-FDJBtThzH-D X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDAzOCBTYWx0ZWRfX+E/3b82Y0+LC 2kO4qn/aKbYFxtpiBWU+XKPvCPZ4u3gD7ucjj1VfvgzNzj2R+cZ9IRr8TRS4arKxBXUGdbnyIXP W0SwdLMzwU2ax39xLYP4f4S4z+1M0mySiekPuZ1AkRgP6ZUgLAg9WE8cMQkR/oBFchyHRD7Mwk6 IOSDTDvY9dfrVWTSYW48jlivzB602lpLy3nrpXjY532elYLd1wBoi55WU1MXEgC9Gc9+QoL1KTM 1OJk/Nlkr3xtls/fXjDgFq9y5Ko55mNl9g1sIS09Nz7uIgQkZuwJxXhvqnc/UiksbMaMCeDBxUP MuaFNDhn8NhOmRUPe1LYzldbT19hezg7gZWTkw8hIt9n5Uk2k69OKldq7IYbAx+1BrjvCQ+RA6B /HvvIV0Ja7WtEs9yBZm/J7D8077eV8ZLO5Z+fNgynLG/gUd18vmRRWUN8QhxcDupVnXNLZSB X-Authority-Analysis: v=2.4 cv=TrfmhCXh c=1 sm=1 tr=0 ts=6822ca7f cx=c_pps a=RP+M6JBNLl+fLTcSJhASfg==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=dt9VzEwgFbYA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=8BRqyYDQAlS27bmPn4kA:9 a=iS9zxrgQBfv6-_F4QbHw:22 X-Proofpoint-ORIG-GUID: 44LBxmetKwHoBhK2GMZt-FDJBtThzH-D X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 clxscore=1015 spamscore=0 malwarescore=0 mlxlogscore=999 suspectscore=0 phishscore=0 bulkscore=0 lowpriorityscore=0 adultscore=0 mlxscore=0 impostorscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130038 User request for remote heap allocation is supported using ioctl interface but support for unmap is missing. This could result in memory leak issues. Add unmap user request support for remote heap. Fixes: 532ad70c6d449 ("misc: fastrpc: Add mmap request assigning for static PD pool") Cc: stable@kernel.org Signed-off-by: Ekansh Gupta --- drivers/misc/fastrpc.c | 62 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 51 insertions(+), 11 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index d54368bf8c5c..b64c5b9e07b5 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -197,6 +197,8 @@ struct fastrpc_buf { struct dma_buf *dmabuf; struct device *dev; void *virt; + /* Type of buffer */ + u32 flag; u64 phys; u64 size; /* Lock for dma buf attachments */ @@ -1867,8 +1869,26 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_buf * err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc, &args[0]); if (!err) { - dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); + if (buf->flag == ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) { + u64 src_perms = 0; + struct qcom_scm_vmperm dst_perms; + u32 i; + + for (i = 0; i < fl->cctx->vmcount; i++) + src_perms |= BIT(fl->cctx->vmperms[i].vmid); + + dst_perms.vmid = QCOM_SCM_VMID_HLOS; + dst_perms.perm = QCOM_SCM_PERM_RWX; + err = qcom_scm_assign_mem(buf->phys, (u64)buf->size, + &src_perms, &dst_perms, 1); + if (err) { + dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n", + buf->phys, buf->size, err); + return err; + } + } fastrpc_buf_free(buf); + dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); } @@ -1882,6 +1902,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) struct fastrpc_req_munmap req; struct device *dev = fl->sctx->dev; int err; + unsigned long flags; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1896,20 +1917,38 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) } spin_unlock(&fl->lock); - if (!buf) { - dev_err(dev, "mmap\t\tpt 0x%09llx [len 0x%08llx] not in list\n", - req.vaddrout, req.size); - return -EINVAL; + if (buf) { + err = fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); + } + return err; } - err = fastrpc_req_munmap_impl(fl, buf); - if (err) { - spin_lock(&fl->lock); - list_add_tail(&buf->node, &fl->mmaps); - spin_unlock(&fl->lock); + spin_lock_irqsave(&fl->cctx->lock, flags); + list_for_each_entry_safe(iter, b, &fl->cctx->rhmaps, node) { + if (iter->raddr == req.vaddrout && iter->size == req.size) { + list_del(&iter->node); + buf = iter; + break; + } } + spin_unlock_irqrestore(&fl->cctx->lock, flags); + if (buf) { + err = fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock_irqsave(&fl->cctx->lock, flags); + list_add_tail(&buf->node, &fl->cctx->rhmaps); + spin_unlock_irqrestore(&fl->cctx->lock, flags); + } + return err; + } + dev_err(dev, "mmap\t\tpt 0x%09llx [len 0x%08llx] not in list\n", + req.vaddrout, req.size); - return err; + return -EINVAL; } static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) @@ -1977,6 +2016,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) /* update the buffer to be able to deallocate the memory on the DSP */ buf->raddr = (uintptr_t) rsp_msg.vaddr; + buf->flag = req.flags; /* let the client know the address to use */ req.vaddrout = rsp_msg.vaddr;