linux-kernel - Re: [PATCH v1 4/5] misc: fastrpc: Remove buffer from list prior to unmap operation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <p6cc5lxufmefeulx5bhlh6q6ivwluqf2muj3hu5e5526fsppuu@brcy6arm7epg>
Date: Mon, 19 May 2025 16:32:23 +0300
From: Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>
To: Ekansh Gupta <ekansh.gupta@....qualcomm.com>
Cc: srinivas.kandagatla@....qualcomm.com, linux-arm-msm@...r.kernel.org,
        gregkh@...uxfoundation.org, quic_bkumar@...cinc.com,
        linux-kernel@...r.kernel.org, quic_chennak@...cinc.com,
        dri-devel@...ts.freedesktop.org, arnd@...db.de, stable@...nel.org
Subject: Re: [PATCH v1 4/5] misc: fastrpc: Remove buffer from list prior to
 unmap operation

On Mon, May 19, 2025 at 04:26:27PM +0530, Ekansh Gupta wrote:
> 
> 
> On 5/19/2025 3:50 PM, Dmitry Baryshkov wrote:
> > On Tue, May 13, 2025 at 09:58:24AM +0530, Ekansh Gupta wrote:
> >> fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is
> >> getting removed from the list after it is unmapped from DSP. This can
> >> create potential race conditions if any other thread removes the entry
> >> from list while unmap operation is ongoing. Remove the entry before
> >> calling unmap operation.
> >>
> >> Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support")
> >> Cc: stable@...nel.org
> >> Signed-off-by: Ekansh Gupta <ekansh.gupta@....qualcomm.com>
> >> ---
> >>  drivers/misc/fastrpc.c | 29 ++++++++++++++++++++++-------
> >>  1 file changed, 22 insertions(+), 7 deletions(-)
> >>

> >
> >> +err_copy:
> >> +	if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
> >> +		spin_lock_irqsave(&fl->cctx->lock, flags);
> >> +		list_del(&buf->node);
> >> +		spin_unlock_irqrestore(&fl->cctx->lock, flags);
> >> +	} else {
> >> +		spin_lock(&fl->lock);
> >> +		list_del(&buf->node);
> >> +		spin_unlock(&fl->lock);
> >> +	}
> > Can we store the spinlock pointer in the struct fastrpc_buf instead?
> this spinlock is used for multiple lists(bufs, maps and ctx).

pointer, not a spinlock itself.

> >
> >>  err_assign:
> >>  	fastrpc_req_munmap_impl(fl, buf);
> >>  
> >> -- 
> >> 2.34.1
> >>
> 

-- 
With best wishes
Dmitry