From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f51.google.com (mail-yx1-f51.google.com [74.125.224.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 06FCD31578E for ; Thu, 25 Jun 2026 08:57:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782377850; cv=none; b=X+ngrM6iEZ4alObyvf0WYnwE3zCfoyeDEG9rnmYPvQaC/lWULRKbD2TDOMeyXncHf95qPOpOcWqFqPYQugi0lxGMkHLZ+MYfnx6MhD341DfuO5PGGSKE/CHFoEwW+wAfCh/jTQg4f2ESvvt61PrKvdxNqzeCazc9e/YnpueTsUM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782377850; c=relaxed/simple; bh=7+RpgeFXilV9LBg54j04AxM1dVDg8zK074PE+ydai/M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cibPmDLLXLPyv7aG35/YuArBv3dQBKLo8bvL2FuDzeTBItb9FNSRO6+/mtjZyvve8wqPKJh+r89JIkpFZnv4BlroSPDvg725zcp0wY8qZGm6vWWfEpqjqDpK7xus1X9oyCigVvx0k1lJBs/fsfoaJIf9FQTroI3t3L1pEBf70rg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gXVhpqjw; arc=none smtp.client-ip=74.125.224.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gXVhpqjw" Received: by mail-yx1-f51.google.com with SMTP id 956f58d0204a3-663167a3ba2so2143255d50.3 for ; Thu, 25 Jun 2026 01:57:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782377848; x=1782982648; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=3HXBGWP+mHV9r0WWwErucYsy42UpdRmWv6NJcEbVBLI=; b=gXVhpqjwqJFHcx12EuO8AanvpBdSfaGcTVJWC5Fo8lHUD2jxcTv1hxFan5diXBQQTk M+kzD7QsLvD/cG4DJgvQhbIygvmVjG0cth2v4/OVSmynwfrcxJwREPQwfA+RQ1PS/ve7 bObLzkxD4wJUXafF65NRxLSpjKyGmgCCFQyLIcvAQzr3QQUr+eHENp7MaydZv6UmUFTG gvNbYpY/+iFDIfVJkpDi96F12vKtEDD2kN8DAvuODXUW/Q5DF43mp2brLDdP9rPSuJK2 0Rcrh8GOrZf05oExTn9AngAWY2AlWeR/wpMXV4LRgv12NosRM+ekzpIbIkkmAQ+iiuwE DMWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782377848; x=1782982648; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=3HXBGWP+mHV9r0WWwErucYsy42UpdRmWv6NJcEbVBLI=; b=gYEUSKrOGOakzmHwDG7cEYsxvBrsS1kVJsB0crMkMD34+zYVp+ie24NzKedyiuFDXq LSFm5kDd395XoUKjko9Su81be300dMMzqPisHhGX5RDVLrm6rJDi1RunLsl42mEyBahX LSDDbQ5Hg2wWsvVJZilG4K2aJn796rM+HsybkF4xi/BsBHTrgRUi31ZvMhIhpp2X9J2y atxrQkj4aT5svk92VCPiFLXrbsj7E81tIasWmV8u1Q/c3am0Bisfl5oaw1GMUJ5NdF2p NXa6j+jZDAMJDXuUjjjN26U12Hr0xFNU1XS1cDGOe8YyBIaYEwktCyFizHJsAyQGfD6Z uGuw== X-Forwarded-Encrypted: i=1; AHgh+RpFWkM+ieri8mj+nH8jA7RYfI9NpTYWOIgBTIgkpRB/uYXHPDcHKrW1j5M2tNpm1+2I/HqtsHhccDmUUTiW@vger.kernel.org X-Gm-Message-State: AOJu0YzZQLo//jSZcnF4YfKMobscV8O3tt6pA7xgIjrF3LilW31D5a87 VEfaAMVF9mQbi4rwNrYz5fk0RrQP4kZrGwbYXRYxWjT8rHYNNEjCUl92B9vVUm/bFUNfOw== X-Gm-Gg: AfdE7cmoEkUSYyToYNnVgRnzzH1++WxdcGd8ndf0VYu2e7oFglwCPGLiyDs90Xmsbg7 6KrTkn2kdV/zmmsySxHFUFJGP3QfxLaizd33Rb1zXmLoicVE1TncYFq4oXWKMs/d5wd17wTv4zx DTzAWID2sYJ51ktAaH32hZ25HRDNUpqbuZzo7NyjuAbb5GNgAY5BMoqMhR1EqUqpBws0eRA8LYd J3zUGS21QdNJVs1x+XmF6vLhVZ+7mrrT/NqfMrd+ZEmVNy07p//v4914GMLB9XFB/Gihj3LXUbT QIefa7Hi27tRiHwj9VGo7B11AS43FKEejjDj3Wcbu3K7FtKJimQrUbzWNycGTrRedjB9Q6aEyCF sKYMAbhHwY2SXh56FXGsfq2tOP7qRAkdeNWGkuRaQ/rnD1/XKhbVirRkX6+Whb8Oqr9D29UuA1R fqmfCK5rAy7GzVZMIInMsLtsyH5w== X-Received: by 2002:a05:690e:b4a:b0:660:ffe0:2df7 with SMTP id 956f58d0204a3-66487c28ae6mr1186398d50.23.1782377847966; Thu, 25 Jun 2026 01:57:27 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-6647f785f6bsm1105061d50.6.2026.06.25.01.57.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jun 2026 01:57:27 -0700 (PDT) From: Yousef Alhouseen To: Srinivas Kandagatla , Amol Maheshwari Cc: Konrad Dybcio , Arnd Bergmann , Greg Kroah-Hartman , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yousef Alhouseen Subject: [PATCH 3/3] misc: fastrpc: protect interrupted mmap cleanup Date: Thu, 25 Jun 2026 10:56:59 +0200 Message-ID: <20260625085659.4469-3-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260625085659.4469-1-alhouseenyousef@gmail.com> References: <20260625085659.4469-1-alhouseenyousef@gmail.com> Precedence: bulk X-Mailing-List: linux-arm-msm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The interrupted invoke path walks and moves fl->mmaps without holding fl->lock, racing concurrent mmap and munmap operations that use the same list. Move the buffers while holding the user lock and use list_del_init() so later cleanup can safely identify moved nodes. Buffers moved to the channel interrupted list are also discarded on rpmsg removal without freeing their coherent DMA allocations. Free them during channel removal so interrupted invokes cannot permanently leak DMA buffers. Signed-off-by: Yousef Alhouseen --- drivers/misc/fastrpc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 50f90e17e..608878052 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1395,10 +1395,12 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel, bail: if (err == -ERESTARTSYS) { + spin_lock(&fl->lock); list_for_each_entry_safe(buf, b, &fl->mmaps, node) { - list_del(&buf->node); + list_del_init(&buf->node); list_add_tail(&buf->node, &fl->cctx->invoke_interrupted_mmaps); } + spin_unlock(&fl->lock); } /* We are done with this compute context */ @@ -2628,8 +2630,10 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) if (cctx->secure_fdevice) misc_deregister(&cctx->secure_fdevice->miscdev); - list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node) - list_del(&buf->node); + list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node) { + list_del_init(&buf->node); + fastrpc_buf_free(buf); + } if (cctx->remote_heap) fastrpc_buf_free(cctx->remote_heap); -- 2.54.0