* Re: [PATCH v2] misc: fastrpc: fix context leak and hang on signal-interrupted invoke
@ 2026-07-03 2:39 kernel test robot
0 siblings, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-07-03 2:39 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <20260701-master-v2-1-566bf8b7bd16@oss.qualcomm.com>
References: <20260701-master-v2-1-566bf8b7bd16@oss.qualcomm.com>
TO: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
TO: Srinivas Kandagatla <srini@kernel.org>
TO: Amol Maheshwari <amahesh@qti.qualcomm.com>
TO: Arnd Bergmann <arnd@arndb.de>
TO: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
TO: "Jorge Ramirez-Ortiz" <jorge.ramirez@oss.qualcomm.com>
CC: linux-arm-msm@vger.kernel.org
CC: dri-devel@lists.freedesktop.org
CC: linux-kernel@vger.kernel.org
CC: stable@kernel.org
CC: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
Hi Anandu,
kernel test robot noticed the following build warnings:
[auto build test WARNING on dc59e4fea9d83f03bad6bddf3fa2e52491777482]
url: https://github.com/intel-lab-lkp/linux/commits/Anandu-Krishnan-E/misc-fastrpc-fix-context-leak-and-hang-on-signal-interrupted-invoke/20260701-161349
base: dc59e4fea9d83f03bad6bddf3fa2e52491777482
patch link: https://lore.kernel.org/r/20260701-master-v2-1-566bf8b7bd16%40oss.qualcomm.com
patch subject: [PATCH v2] misc: fastrpc: fix context leak and hang on signal-interrupted invoke
:::::: branch date: 2 days ago
:::::: commit date: 2 days ago
config: sparc-randconfig-r071-20260702 (https://download.01.org/0day-ci/archive/20260703/202607031058.69A6d6WW-lkp@intel.com/config)
compiler: sparc64-linux-gcc (GCC) 13.4.0
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607031058.69A6d6WW-lkp@intel.com/
New smatch warnings:
drivers/misc/fastrpc.c:1340 fastrpc_internal_invoke() warn: 'ctx' can also be NULL
Old smatch warnings:
drivers/misc/fastrpc.c:1356 fastrpc_internal_invoke() warn: 'ctx' can also be NULL
drivers/misc/fastrpc.c:1440 fastrpc_init_create_static_process() error: we previously assumed 'fl->cctx->remote_heap' could be null (see line 1430)
vim +/ctx +1340 drivers/misc/fastrpc.c
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1287
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1288 static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1289 u32 handle, u32 sc,
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1290 struct fastrpc_invoke_args *args)
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1291 {
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1292 struct fastrpc_invoke_ctx *ctx = NULL;
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1293 int err = 0;
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1294
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1295 if (!fl->sctx)
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1296 return -EINVAL;
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1297
2e369878bd4399 Bjorn Andersson 2019-08-29 1298 if (!fl->cctx->rpdev)
2e369878bd4399 Bjorn Andersson 2019-08-29 1299 return -EPIPE;
2e369878bd4399 Bjorn Andersson 2019-08-29 1300
20c40794eb85ea Dmitry Baryshkov 2021-02-12 1301 if (handle == FASTRPC_INIT_HANDLE && !kernel) {
20c40794eb85ea Dmitry Baryshkov 2021-02-12 1302 dev_warn_ratelimited(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n", handle);
20c40794eb85ea Dmitry Baryshkov 2021-02-12 1303 return -EPERM;
20c40794eb85ea Dmitry Baryshkov 2021-02-12 1304 }
20c40794eb85ea Dmitry Baryshkov 2021-02-12 1305
d79842457e9cbe Anandu Krishnan E 2026-07-01 1306 if (!kernel) {
d79842457e9cbe Anandu Krishnan E 2026-07-01 1307 ctx = fastrpc_context_restore_interrupted(fl, sc);
d79842457e9cbe Anandu Krishnan E 2026-07-01 1308 if (IS_ERR(ctx))
d79842457e9cbe Anandu Krishnan E 2026-07-01 1309 return PTR_ERR(ctx);
d79842457e9cbe Anandu Krishnan E 2026-07-01 1310 if (ctx)
d79842457e9cbe Anandu Krishnan E 2026-07-01 1311 goto wait;
d79842457e9cbe Anandu Krishnan E 2026-07-01 1312 }
d79842457e9cbe Anandu Krishnan E 2026-07-01 1313
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1314 ctx = fastrpc_context_alloc(fl, kernel, sc, args);
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1315 if (IS_ERR(ctx))
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1316 return PTR_ERR(ctx);
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1317
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1318 err = fastrpc_get_args(kernel, ctx);
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1319 if (err)
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1320 goto bail;
415a0729bd1225 Srinivas Kandagatla 2019-03-07 1321
415a0729bd1225 Srinivas Kandagatla 2019-03-07 1322 /* make sure that all CPU memory writes are seen by DSP */
415a0729bd1225 Srinivas Kandagatla 2019-03-07 1323 dma_wmb();
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1324 /* Send invoke buffer to remote dsp */
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1325 err = fastrpc_invoke_send(fl->sctx, ctx, kernel, handle);
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1326 if (err)
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1327 goto bail;
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1328
d79842457e9cbe Anandu Krishnan E 2026-07-01 1329 wait:
55bcda35584c99 Jorge Ramirez-Ortiz 2019-10-09 1330 if (kernel) {
d79842457e9cbe Anandu Krishnan E 2026-07-01 1331 if (!wait_for_completion_timeout(&ctx->work, 10 * HZ)) {
55bcda35584c99 Jorge Ramirez-Ortiz 2019-10-09 1332 err = -ETIMEDOUT;
d79842457e9cbe Anandu Krishnan E 2026-07-01 1333 dev_warn(fl->sctx->dev,
d79842457e9cbe Anandu Krishnan E 2026-07-01 1334 "fastrpc_invoke: TIMEOUT ctxid=0x%llx handle=0x%x nscalars=%d\n",
d79842457e9cbe Anandu Krishnan E 2026-07-01 1335 ctx->ctxid, handle, ctx->nscalars);
d79842457e9cbe Anandu Krishnan E 2026-07-01 1336 }
55bcda35584c99 Jorge Ramirez-Ortiz 2019-10-09 1337 } else {
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1338 err = wait_for_completion_interruptible(&ctx->work);
d79842457e9cbe Anandu Krishnan E 2026-07-01 1339 if (err == -ERESTARTSYS)
d79842457e9cbe Anandu Krishnan E 2026-07-01 @1340 dev_warn(fl->sctx->dev,
d79842457e9cbe Anandu Krishnan E 2026-07-01 1341 "fastrpc_invoke: INTERRUPTED ctxid=0x%llx handle=0x%x nscalars=%d\n",
d79842457e9cbe Anandu Krishnan E 2026-07-01 1342 ctx->ctxid, handle, ctx->nscalars);
55bcda35584c99 Jorge Ramirez-Ortiz 2019-10-09 1343 }
55bcda35584c99 Jorge Ramirez-Ortiz 2019-10-09 1344
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1345 if (err)
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1346 goto bail;
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1347
415a0729bd1225 Srinivas Kandagatla 2019-03-07 1348 /* make sure that all memory writes by DSP are seen by CPU */
415a0729bd1225 Srinivas Kandagatla 2019-03-07 1349 dma_rmb();
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1350 /* populate all the output buffers with results */
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1351 err = fastrpc_put_args(ctx, kernel);
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1352 if (err)
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1353 goto bail;
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1354
1c8093591d1e37 Ekansh Gupta 2023-10-13 1355 /* Check the response from remote dsp */
1c8093591d1e37 Ekansh Gupta 2023-10-13 1356 err = ctx->retval;
1c8093591d1e37 Ekansh Gupta 2023-10-13 1357 if (err)
1c8093591d1e37 Ekansh Gupta 2023-10-13 1358 goto bail;
1c8093591d1e37 Ekansh Gupta 2023-10-13 1359
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1360 bail:
d79842457e9cbe Anandu Krishnan E 2026-07-01 1361 if (ctx && err == -ERESTARTSYS) {
d79842457e9cbe Anandu Krishnan E 2026-07-01 1362 fastrpc_context_save_interrupted(ctx);
d79842457e9cbe Anandu Krishnan E 2026-07-01 1363 } else if (ctx) {
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1364 spin_lock(&fl->lock);
d79842457e9cbe Anandu Krishnan E 2026-07-01 1365 list_del_init(&ctx->node);
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1366 spin_unlock(&fl->lock);
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1367 fastrpc_context_put(ctx);
387f625585d1a5 Jorge Ramirez-Ortiz 2019-10-09 1368 }
0871561055e666 Abel Vesa 2022-11-25 1369
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1370 if (err)
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1371 dev_dbg(fl->sctx->dev, "Error: Invoke Failed %d\n", err);
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1372
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1373 return err;
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1374 }
c68cfb718c8f97 Srinivas Kandagatla 2019-02-08 1375
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH v2] misc: fastrpc: fix context leak and hang on signal-interrupted invoke
@ 2026-07-01 8:11 Anandu Krishnan E
2026-07-01 8:27 ` sashiko-bot
0 siblings, 1 reply; 3+ messages in thread
From: Anandu Krishnan E @ 2026-07-01 8:11 UTC (permalink / raw)
To: Srinivas Kandagatla, Amol Maheshwari, Arnd Bergmann,
Greg Kroah-Hartman, Jorge Ramirez-Ortiz
Cc: linux-arm-msm, dri-devel, linux-kernel, stable,
Srinivas Kandagatla, Anandu Krishnan E
fastrpc invokes work by sending an RPC message to the DSP and blocking
in wait_for_completion_interruptible() until the DSP responds. If a
signal arrives during this wait, the syscall returns -ERESTARTSYS and
the invoke context which holds the in-flight DMA buffers and
completion state is left stranded in fl->pending.
On the next syscall attempt (either auto-restarted by the kernel via
SA_RESTART or manually retried by user-space after EINTR), a fresh
context is allocated and the RPC message is re-sent to the DSP. This
has two consequences:
- The original context leaks in fl->pending until the file is closed.
- The DSP receives a duplicate invocation. If the DSP was mid-way
through processing the first request and had issued a reverse RPC
call back to the host, the retry sends a new forward request
instead of the expected reverse-RPC response. The DSP thread
waiting for that response is never woken, causing a hang.
Fix this by saving the interrupted context to a new fl->interrupted
list on -ERESTARTSYS. When the same thread retries the invoke with a
matching sc, restore the context and jump directly to the wait,
skipping context allocation and message re-send.
Three additional bugs are also fixed:
1. fastrpc_context_save_interrupted() did not drop the extra kref that
fastrpc_invoke_send() took, so the worker's put only reached 1 and
the context was never freed. Drop the reference in save_interrupted()
so the worker's put reaches 0 and triggers context_free.
2. The bail path skipped context cleanup on -ETIMEDOUT, leaking the
context. Remove the -ETIMEDOUT exception so timed-out contexts are
freed like any other error path.
3. fastrpc_context_free() did not remove the context from fl->interrupted
before freeing it. A context freed via a racing channel removal left
a dangling node in the list. Add list_del_init() guarded by fl->lock
before releasing resources.
Also drain fl->interrupted on process exit, complete any sleeping
contexts with -EPIPE and schedule put_wq to drop the worker ref when
the rpmsg channel is removed, and add dev_warn() on TIMEOUT and
ERESTARTSYS to aid post-mortem debugging.
Remove the obsolete invoke_interrupted_mmaps mechanism from
fastrpc_channel_ctx; context resources are now kept alive through the
context refcount rather than by migrating mmaps to a channel-level list.
Fixes: 387f625585d1 ("misc: fastrpc: handle interrupted contexts")
Cc: stable@kernel.org
Co-developed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Signed-off-by: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
---
This patch fixes a context leak and DSP hang that occur when a
fastrpc invoke syscall is interrupted by a signal, along with three
follow-on bugs found during review.
Changes in v2:
- Fix kref imbalance: fastrpc_context_save_interrupted() now drops the
extra reference taken by fastrpc_invoke_send(), so the worker's put
correctly reaches 0 and triggers context_free.
- Fix -ETIMEDOUT context leak: remove the ETIMEDOUT exception from the
bail path so timed-out kernel invocations go through the same
list_del_init + context_put cleanup as all other error paths.
- Fix dangling node: fastrpc_context_free() now calls list_del_init()
under fl->lock before releasing resources, preventing a dangling node
in fl->interrupted if a racing channel removal fires put_wq.
- fastrpc_notify_users() now calls schedule_work(&ctx->put_work) for
interrupted contexts to drop the worker ref on channel removal.
- Add dev_warn() on TIMEOUT and ERESTARTSYS for post-mortem debugging.
- Use list_del_init() instead of list_del() in the bail path.
Link to v1: https://lore.kernel.org/all/20260525124222.3082420-1-anandu.e@oss.qualcomm.com/
---
drivers/misc/fastrpc.c | 101 +++++++++++++++++++++++++++++++++++++++----------
1 file changed, 82 insertions(+), 19 deletions(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f3a49384586d..c0859a501617 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -280,7 +280,6 @@ struct fastrpc_channel_ctx {
struct fastrpc_device *secure_fdevice;
struct fastrpc_device *fdevice;
struct fastrpc_buf *remote_heap;
- struct list_head invoke_interrupted_mmaps;
bool secure;
bool unsigned_support;
u64 dma_mask;
@@ -297,6 +296,7 @@ struct fastrpc_user {
struct list_head user;
struct list_head maps;
struct list_head pending;
+ struct list_head interrupted;
struct list_head mmaps;
struct fastrpc_channel_ctx *cctx;
@@ -522,6 +522,11 @@ static void fastrpc_user_free(struct kref *ref)
fastrpc_context_put(ctx);
}
+ list_for_each_entry_safe(ctx, n, &fl->interrupted, node) {
+ list_del(&ctx->node);
+ fastrpc_context_put(ctx);
+ }
+
list_for_each_entry_safe(map, m, &fl->maps, node)
fastrpc_map_put(map);
@@ -557,6 +562,12 @@ static void fastrpc_context_free(struct kref *ref)
cctx = ctx->cctx;
fl = ctx->fl;
+ /* Remove from fl->interrupted if present; no-op for normal paths. */
+ spin_lock(&fl->lock);
+ if (!list_empty(&ctx->node))
+ list_del_init(&ctx->node);
+ spin_unlock(&fl->lock);
+
for (i = 0; i < ctx->nbufs; i++)
fastrpc_map_put(ctx->maps[i]);
@@ -594,6 +605,42 @@ static void fastrpc_context_put_wq(struct work_struct *work)
fastrpc_context_put(ctx);
}
+static void fastrpc_context_save_interrupted(struct fastrpc_invoke_ctx *ctx)
+{
+ spin_lock(&ctx->fl->lock);
+ list_del(&ctx->node);
+ list_add_tail(&ctx->node, &ctx->fl->interrupted);
+ spin_unlock(&ctx->fl->lock);
+ /*
+ * invoke_send bumped the kref to 2; the bail path skips the put
+ * for ERESTARTSYS. Drop it here so the worker's put reaches 0
+ * and triggers context_free.
+ */
+ fastrpc_context_put(ctx);
+}
+
+static struct fastrpc_invoke_ctx *fastrpc_context_restore_interrupted(
+ struct fastrpc_user *fl, u32 sc)
+{
+ struct fastrpc_invoke_ctx *ctx = NULL, *ictx, *n;
+
+ spin_lock(&fl->lock);
+ list_for_each_entry_safe(ictx, n, &fl->interrupted, node) {
+ if (ictx->pid != current->pid)
+ continue;
+ if (ictx->sc != sc || ictx->fl != fl) {
+ spin_unlock(&fl->lock);
+ return ERR_PTR(-EINVAL);
+ }
+ ctx = ictx;
+ list_del(&ctx->node);
+ list_add_tail(&ctx->node, &fl->pending);
+ break;
+ }
+ spin_unlock(&fl->lock);
+ return ctx;
+}
+
#define CMP(aa, bb) ((aa) == (bb) ? 0 : (aa) < (bb) ? -1 : 1)
static int olaps_cmp(const void *a, const void *b)
{
@@ -1243,8 +1290,6 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,
struct fastrpc_invoke_args *args)
{
struct fastrpc_invoke_ctx *ctx = NULL;
- struct fastrpc_buf *buf, *b;
-
int err = 0;
if (!fl->sctx)
@@ -1258,6 +1303,14 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,
return -EPERM;
}
+ if (!kernel) {
+ ctx = fastrpc_context_restore_interrupted(fl, sc);
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+ if (ctx)
+ goto wait;
+ }
+
ctx = fastrpc_context_alloc(fl, kernel, sc, args);
if (IS_ERR(ctx))
return PTR_ERR(ctx);
@@ -1273,11 +1326,20 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,
if (err)
goto bail;
+wait:
if (kernel) {
- if (!wait_for_completion_timeout(&ctx->work, 10 * HZ))
+ if (!wait_for_completion_timeout(&ctx->work, 10 * HZ)) {
err = -ETIMEDOUT;
+ dev_warn(fl->sctx->dev,
+ "fastrpc_invoke: TIMEOUT ctxid=0x%llx handle=0x%x nscalars=%d\n",
+ ctx->ctxid, handle, ctx->nscalars);
+ }
} else {
err = wait_for_completion_interruptible(&ctx->work);
+ if (err == -ERESTARTSYS)
+ dev_warn(fl->sctx->dev,
+ "fastrpc_invoke: INTERRUPTED ctxid=0x%llx handle=0x%x nscalars=%d\n",
+ ctx->ctxid, handle, ctx->nscalars);
}
if (err)
@@ -1296,21 +1358,15 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,
goto bail;
bail:
- if (err != -ERESTARTSYS && err != -ETIMEDOUT) {
- /* We are done with this compute context */
+ if (ctx && err == -ERESTARTSYS) {
+ fastrpc_context_save_interrupted(ctx);
+ } else if (ctx) {
spin_lock(&fl->lock);
- list_del(&ctx->node);
+ list_del_init(&ctx->node);
spin_unlock(&fl->lock);
fastrpc_context_put(ctx);
}
- if (err == -ERESTARTSYS) {
- list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
- list_del(&buf->node);
- list_add_tail(&buf->node, &fl->cctx->invoke_interrupted_mmaps);
- }
- }
-
if (err)
dev_dbg(fl->sctx->dev, "Error: Invoke Failed %d\n", err);
@@ -1662,6 +1718,7 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
spin_lock_init(&fl->lock);
mutex_init(&fl->mutex);
INIT_LIST_HEAD(&fl->pending);
+ INIT_LIST_HEAD(&fl->interrupted);
INIT_LIST_HEAD(&fl->maps);
INIT_LIST_HEAD(&fl->mmaps);
INIT_LIST_HEAD(&fl->user);
@@ -2460,7 +2517,6 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev)
rdev->dma_mask = &data->dma_mask;
dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32));
INIT_LIST_HEAD(&data->users);
- INIT_LIST_HEAD(&data->invoke_interrupted_mmaps);
spin_lock_init(&data->lock);
idr_init(&data->ctx_idr);
data->domain_id = domain_id;
@@ -2493,13 +2549,23 @@ static void fastrpc_notify_users(struct fastrpc_user *user)
ctx->retval = -EPIPE;
complete(&ctx->work);
}
+ /*
+ * Interrupted contexts hold two refs: one for the invoker and one
+ * for the async worker from fastrpc_invoke_send. Complete them so
+ * any blocked retry wakes, and schedule put_wq to drop the worker
+ * ref -- the invoker ref is released by fastrpc_user_free().
+ */
+ list_for_each_entry(ctx, &user->interrupted, node) {
+ ctx->retval = -EPIPE;
+ complete(&ctx->work);
+ schedule_work(&ctx->put_work);
+ }
spin_unlock(&user->lock);
}
static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev)
{
struct fastrpc_channel_ctx *cctx = dev_get_drvdata(&rpdev->dev);
- struct fastrpc_buf *buf, *b;
struct fastrpc_user *user;
unsigned long flags;
@@ -2516,9 +2582,6 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev)
if (cctx->secure_fdevice)
misc_deregister(&cctx->secure_fdevice->miscdev);
- list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node)
- list_del(&buf->node);
-
if (cctx->remote_heap)
fastrpc_buf_free(cctx->remote_heap);
---
base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
change-id: 20260701-master-2ba6246f29d1
Best regards,
--
Anandu Krishnan E <anandu.e@oss.qualcomm.com>
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH v2] misc: fastrpc: fix context leak and hang on signal-interrupted invoke
2026-07-01 8:11 Anandu Krishnan E
@ 2026-07-01 8:27 ` sashiko-bot
0 siblings, 0 replies; 3+ messages in thread
From: sashiko-bot @ 2026-07-01 8:27 UTC (permalink / raw)
To: Anandu Krishnan E; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [Critical] Restoring an interrupted context fails to increment its reference count, leading to a Use-After-Free and Double Free when the syscall completes.
- [Critical] Retrying an interrupted fastrpc invocation with a newly allocated arguments structure forces the kernel to blindly write output data to old, potentially invalidated buffer addresses.
- [High] If a thread's fastrpc call is interrupted and it subsequently attempts a completely different fastrpc call, it will be permanently blocked from using the device.
- [High] Double-scheduling `ctx->put_work` in `fastrpc_notify_users()` causes list corruption and a Use-After-Free if the async worker is already executing.
--
commit d067e3f966edecc9e2338c8eea087bb05365a462
Author: Anandu Krishnan E <anandu.e@oss.qualcomm.com>
misc: fastrpc: fix context leak and hang on signal-interrupted invoke
This commit aims to fix a context leak and hang when a fastrpc invocation is
interrupted by a signal. It saves the interrupted context to a new list and
restores it on the next syscall attempt.
> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> index f3a49384586d1..c0859a5016179 100644
> --- a/drivers/misc/fastrpc.c
> +++ b/drivers/misc/fastrpc.c
[ ... ]
> @@ -594,6 +605,42 @@ static void fastrpc_context_put_wq(struct work_struct *work)
> fastrpc_context_put(ctx);
> }
>
> +static void fastrpc_context_save_interrupted(struct fastrpc_invoke_ctx *ctx)
> +{
> + spin_lock(&ctx->fl->lock);
> + list_del(&ctx->node);
> + list_add_tail(&ctx->node, &ctx->fl->interrupted);
> + spin_unlock(&ctx->fl->lock);
> + /*
> + * invoke_send bumped the kref to 2; the bail path skips the put
> + * for ERESTARTSYS. Drop it here so the worker's put reaches 0
> + * and triggers context_free.
> + */
> + fastrpc_context_put(ctx);
> +}
> +
> +static struct fastrpc_invoke_ctx *fastrpc_context_restore_interrupted(
> + struct fastrpc_user *fl, u32 sc)
> +{
> + struct fastrpc_invoke_ctx *ctx = NULL, *ictx, *n;
> +
> + spin_lock(&fl->lock);
> + list_for_each_entry_safe(ictx, n, &fl->interrupted, node) {
> + if (ictx->pid != current->pid)
> + continue;
> + if (ictx->sc != sc || ictx->fl != fl) {
> + spin_unlock(&fl->lock);
> + return ERR_PTR(-EINVAL);
[Severity: High]
If a thread gets interrupted and attempts a new fastrpc call with a different
sc, this returns -EINVAL but leaves the old context on fl->interrupted.
Will every subsequent fastrpc call by this thread with a different sc hit this
same mismatch and instantly fail with -EINVAL, effectively wedging the thread?
> + }
> + ctx = ictx;
> + list_del(&ctx->node);
> + list_add_tail(&ctx->node, &fl->pending);
> + break;
[Severity: Critical]
Does restoring the context here require incrementing its reference count via
fastrpc_context_get()?
Since the invoker's reference is intentionally dropped in
fastrpc_context_save_interrupted(), if the async worker completes the work and
drops its reference, could the user thread wake up and unconditionally call
fastrpc_context_put() in the bail path on freed memory?
> + }
> + spin_unlock(&fl->lock);
> + return ctx;
> +}
> +
[ ... ]
> @@ -1258,6 +1303,14 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,
> return -EPERM;
> }
>
> + if (!kernel) {
> + ctx = fastrpc_context_restore_interrupted(fl, sc);
> + if (IS_ERR(ctx))
> + return PTR_ERR(ctx);
> + if (ctx)
> + goto wait;
[Severity: Critical]
By jumping directly to wait, does this bypass argument extraction for retries?
If a user thread unwinds its stack after a signal and initiates a completely
different call that happens to have the same sc, it seems the output data
might be copied directly to the old buffer addresses stored in ctx->args,
which could now contain other sensitive data.
> + }
> +
> ctx = fastrpc_context_alloc(fl, kernel, sc, args);
> if (IS_ERR(ctx))
> return PTR_ERR(ctx);
[ ... ]
> @@ -2493,13 +2549,23 @@ static void fastrpc_notify_users(struct fastrpc_user *user)
> ctx->retval = -EPIPE;
> complete(&ctx->work);
> }
> + /*
> + * Interrupted contexts hold two refs: one for the invoker and one
> + * for the async worker from fastrpc_invoke_send. Complete them so
> + * any blocked retry wakes, and schedule put_wq to drop the worker
> + * ref -- the invoker ref is released by fastrpc_user_free().
> + */
> + list_for_each_entry(ctx, &user->interrupted, node) {
> + ctx->retval = -EPIPE;
> + complete(&ctx->work);
> + schedule_work(&ctx->put_work);
[Severity: High]
Is it safe to unconditionally schedule ctx->put_work here?
If a DSP response arrives concurrently and the async worker has already started
executing fastrpc_context_put_wq(), its WORK_STRUCT_PENDING flag would be
clear.
Could this allow the work to be queued a second time, triggering a
use-after-free in the workqueue core once the first execution frees the
context?
> + }
> spin_unlock(&user->lock);
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260701-master-v2-1-566bf8b7bd16@oss.qualcomm.com?part=1
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-03 2:40 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-03 2:39 [PATCH v2] misc: fastrpc: fix context leak and hang on signal-interrupted invoke kernel test robot
-- strict thread matches above, loose matches on Subject: below --
2026-07-01 8:11 Anandu Krishnan E
2026-07-01 8:27 ` sashiko-bot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.