From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4853B471D00 for ; Fri, 24 Jul 2026 22:33:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932431; cv=none; b=SIpCOyEsVU6r7rDoFUywoNRYKqb/xJlhBs1pecKmwQDDD8/zAxyIxGXJcQsoCMpGePYA1f/9WPOJHORKTpjxBLlEcv/I1dk+MHehvD7Qo+u9fcz6/BEjAoIR089kV7sr1Yd6YioPnE22lXnAdmHX/XuVqouYhpIv4nXeLxIP/p8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784932431; c=relaxed/simple; bh=zxAUBmki0hoMzwzRFtRrwN7bEtYyFXkoyPW+Z4z4FEw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=s/uWmp50tI+ypqLT/NrAzphmNHr7IskeaauXZ+C+p8GYpUYF5Jlb3/owTGo/4zHJp2k5yTN0nPQoAQzvkCD3441CmFzpMCOs5VAZoO2xaWgrDUyHq3zGTkijUDB2XjdkyNmrQeXICI0tvLRY3bYJLGta09zGQa87LguzzK9MyeY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=D/vfjiZE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="D/vfjiZE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BE1C1F00A3D; Fri, 24 Jul 2026 22:33:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784932430; bh=wdpSEkTXHl2CC+FXG9BoypmYetlzzyXbprvrW2ww2H0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=D/vfjiZEymyru6MPCXtgNQ/eyuI77FileRDe4dSc3yTMKGFYTFFaQ12BZ7RCN16dv 7+wuTE8IMNNSIUgBK2H+ULOvbdRxXCuyKrbiandT18GEFOnHrOHTNor2zkTNT47uxr WuVU9mrIYG33Lo7lIOy9YzvSbPx7u6kNM635OpwVAt4xglHvtkgOo+GaKJ3iIRQILz ab6O7Bh6PIfeL1uvlLNMZ6Q012tPOel0O2BFuRIDhaTBaC7IDaccL7v9Ayw74UyGQ3 H620E+eTYCbHPPQC2uZdNN84cc+Uke8vfEYGyYqMgjkDQmO+F5XSen8cyLvGrCvOL3 RAEpINfFo3wvQ== From: srini@kernel.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Ekansh Gupta , stable@kernel.org, Dmitry Baryshkov , Jianping Li , Srinivas Kandagatla Subject: [PATCH 2/5] misc: fastrpc: Remove buffer from list prior to unmap operation Date: Fri, 24 Jul 2026 23:33:38 +0100 Message-ID: <20260724223342.629168-3-srini@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260724223342.629168-1-srini@kernel.org> References: <20260724223342.629168-1-srini@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Ekansh Gupta fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if multiple threads invoke unmap concurrently, where one thread may remove the entry from the list while another thread's unmap operation is still ongoing. Fix this by removing the buffer entry from the list before calling the unmap operation. If the unmap fails, the entry is re-added to the list so that userspace can retry the unmap, or alternatively, the buffer will be cleaned up during device release when the DSP process is torn down and all DSP-side mappings are freed along with remaining buffers in the list. Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") Cc: stable@kernel.org Reviewed-by: Dmitry Baryshkov Signed-off-by: Ekansh Gupta Signed-off-by: Jianping Li Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 4f01ebfa6f95..12dcd2e737c3 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1889,9 +1889,6 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_buf * &args[0]); if (!err) { dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); - spin_lock(&fl->lock); - list_del(&buf->node); - spin_unlock(&fl->lock); fastrpc_buf_free(buf); } else { dev_err(dev, "unmmap\tpt 0x%09lx ERROR\n", buf->raddr); @@ -1905,6 +1902,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) struct fastrpc_buf *buf = NULL, *iter, *b; struct fastrpc_req_munmap req; struct device *dev = fl->sctx->dev; + int err; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -1912,6 +1910,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) spin_lock(&fl->lock); list_for_each_entry_safe(iter, b, &fl->mmaps, node) { if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) { + list_del(&iter->node); buf = iter; break; } @@ -1924,7 +1923,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, char __user *argp) return -EINVAL; } - return fastrpc_req_munmap_impl(fl, buf); + err = fastrpc_req_munmap_impl(fl, buf); + if (err) { + spin_lock(&fl->lock); + list_add_tail(&buf->node, &fl->mmaps); + spin_unlock(&fl->lock); + } + + return err; } static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) -- 2.53.0