misc: fastrpc: avoid duplicate DMA mappings in fastrpc_create_maps() - #774
misc: fastrpc: avoid duplicate DMA mappings in fastrpc_create_maps()#774Jianping (Jianping-Li) wants to merge 1 commit into
Conversation
|
Merge Check Failed: No Change Task Found No associated change tasks found for CR 4490320 on any of the following entities: Entities:
CR: 4490320 Please ensure the CR has a change task associated with at least one of the entities for this branch. |
1 similar comment
|
Merge Check Failed: No Change Task Found No associated change tasks found for CR 4490320 on any of the following entities: Entities:
CR: 4490320 Please ensure the CR has a change task associated with at least one of the entities for this branch. |
PR #774 — validate-patchPR: #774
Final Summary
|
PR #774 — checker-log-analyzerPR: #774
Detailed report: Full report
|
eeca32c to
e4b5177
Compare
PR #774 — validate-patchPR: #774
Final Summary
|
PR #774 — checker-log-analyzerPR: #774
Detailed report: Full report
|
Test Matrix
|
…te_maps() DMA handles passed as invoke arguments (scalars beyond nbufs) may refer to the same dma_buf fd as an input/output buffer argument. Taking an extra reference for such DMA handle maps leads to duplicate mappings and an unbalanced reference count, since DMA handle maps are released separately when the DSP returns the fd through the fdlist. Fix this by not taking an extra reference for DMA handle arguments (take_ref = false) and tagging them with FASTRPC_MAP_DMA_HANDLE. As these maps are borrowed references, fastrpc_get_args() re-validates the map via fastrpc_map_lookup() before dereferencing it, so it is not used after being freed. fastrpc_put_args() only releases maps flagged as FASTRPC_MAP_DMA_HANDLE and clears the flag to guarantee the map is freed exactly once. Also reject FASTRPC_MAP_DMA_HANDLE in fastrpc_req_mem_map(), since such handles are already mapped implicitly during the remote invoke call and must not be mapped again through the explicit MEM_MAP path. Link: https://lore.kernel.org/all/20260716113254.570-1-jianping.li@oss.qualcomm.com/ Fixes: 10df039 ("misc: fastrpc: Skip reference for DMA handles") Cc: stable@kernel.org Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
e4b5177 to
75f4914
Compare
Test jobs on 75f4914 |
Test Matrix
|
fastrpc_create_maps() performs map lookup only for buffer arguments (i < ctx->nbufs) via fastrpc_map_create(). For
arguments beyond this range, no lookup is performed, which can result in duplicate DMA mappings for the same file descriptor.
Additionally, if the same file descriptor is passed multiple times within a single invocation, performing lookups with
reference counting would increment the reference multiple times, while fastrpc_put_args() would release it only once,
leading to an imbalanced reference count.
Fix this by allowing fastrpc_map_create() to control whether the lookup should take a reference. For arguments beyond
ctx->nbufs, the lookup is performed without taking a reference, ensuring that existing mappings are reused without introducing duplicate DMA mappings or reference count imbalance.
CRs-Fixed: 4490320