The Linux Kernel Mailing List
 help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: Jianping Li <jianping.li@oss.qualcomm.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>,
	amahesh@qti.qualcomm.com, arnd@arndb.de, abelvesa@kernel.org,
	jorge.ramirez-ortiz@linaro.org,
	Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>,
	linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org,
	linux-kernel@vger.kernel.org, quic_chennak@quicinc.com,
	stable@kernel.org
Subject: Re: [PATCH v5 2/5] misc: fastrpc: Remove buffer from list prior to unmap operation
Date: Fri, 22 May 2026 09:03:54 +0200	[thread overview]
Message-ID: <2026052211-pavilion-compost-5fcd@gregkh> (raw)
In-Reply-To: <37146a3a-b18f-40f1-b95b-0ac19bf6c07a@oss.qualcomm.com>

On Fri, May 22, 2026 at 02:55:29PM +0800, Jianping Li wrote:
> 
> On 5/15/2026 9:36 PM, Dmitry Baryshkov wrote:
> > On Fri, May 15, 2026 at 08:42:14PM +0800, Jianping Li wrote:
> > > From: Ekansh Gupta<ekansh.gupta@oss.qualcomm.com>
> > > 
> > > fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is
> > > getting removed from the list after it is unmapped from DSP. This can
> > > create potential race conditions if any other thread removes the entry
> > > from list while unmap operation is ongoing. Remove the entry before
> > How can it remove the entry from the list?
> 
> Multiple threads sharing the same file descriptor may invoke unmap concurrently.

multiple threads sharing the same file descriptor is a horrible
userspace bug.  If you do that, you get what you deserve :)

thanks,

greg k-h

  parent reply	other threads:[~2026-05-22  7:04 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-15 12:42 [PATCH v5 0/5] misc: fastrpc: Add missing bug fixes Jianping Li
2026-05-15 12:42 ` [PATCH v5 1/5] misc: fastrpc: Fix initial memory allocation for Audio PD memory pool Jianping Li
2026-05-15 13:33   ` Dmitry Baryshkov
2026-05-22  6:37     ` Jianping Li
2026-05-15 12:42 ` [PATCH v5 2/5] misc: fastrpc: Remove buffer from list prior to unmap operation Jianping Li
2026-05-15 13:36   ` Dmitry Baryshkov
     [not found]     ` <37146a3a-b18f-40f1-b95b-0ac19bf6c07a@oss.qualcomm.com>
2026-05-22  7:03       ` Greg KH [this message]
     [not found]         ` <d9248bf3-ef48-4c04-ad7d-debc8854bae5@oss.qualcomm.com>
2026-05-25  5:06           ` Greg KH
2026-05-25  8:28             ` Dmitry Baryshkov
2026-05-25 19:15               ` Greg KH
2026-05-25  8:30       ` Dmitry Baryshkov
2026-05-25  9:34         ` Jianping Li
2026-05-25  9:35           ` Dmitry Baryshkov
2026-05-26  6:59             ` Jianping Li
2026-05-26  7:06               ` Dmitry Baryshkov
2026-05-26  7:25                 ` Jianping Li
2026-05-15 12:42 ` [PATCH v5 3/5] misc: fastrpc: Fail Audio PD init when reserved memory is missing Jianping Li
2026-05-15 13:37   ` Dmitry Baryshkov
2026-05-22  7:34     ` Jianping Li
2026-05-18  7:59   ` Konrad Dybcio
2026-05-22  9:08     ` Jianping Li
2026-05-15 12:42 ` [PATCH v5 4/5] misc: fastrpc: Allocate entire reserved memory for Audio PD in probe Jianping Li
2026-05-15 13:38   ` Dmitry Baryshkov
2026-05-22  7:47     ` Jianping Li
2026-05-25  8:32       ` Dmitry Baryshkov
2026-05-25  9:44         ` Jianping Li
2026-05-15 12:42 ` [PATCH v5 5/5] misc: fastrpc: Allow fastrpc_buf_free() to accept NULL Jianping Li
2026-05-17 21:12   ` Dmitry Baryshkov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2026052211-pavilion-compost-5fcd@gregkh \
    --to=gregkh@linuxfoundation.org \
    --cc=abelvesa@kernel.org \
    --cc=amahesh@qti.qualcomm.com \
    --cc=arnd@arndb.de \
    --cc=dmitry.baryshkov@oss.qualcomm.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=ekansh.gupta@oss.qualcomm.com \
    --cc=jianping.li@oss.qualcomm.com \
    --cc=jorge.ramirez-ortiz@linaro.org \
    --cc=linux-arm-msm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=quic_chennak@quicinc.com \
    --cc=stable@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox