From 21df30e2cf9dfda26d3567cc73d67c1d92da2bae Mon Sep 17 00:00:00 2001 From: Jianping Li Date: Thu, 25 Jun 2026 11:30:44 +0800 Subject: [PATCH] FROMLIST: misc: fastrpc: avoid duplicate DMA mappings in fastrpc_create_maps() fastrpc_create_maps() performs map lookup only for buffer arguments (i < ctx->nbufs) via fastrpc_map_create(). For arguments beyond this range, no lookup is performed, which can result in duplicate DMA mappings for the same file descriptor. Additionally, if the same file descriptor is passed multiple times within a single invocation, performing lookups with reference counting would increment the reference multiple times, while fastrpc_put_args() would release it only once, leading to an imbalanced reference count. Fix this by allowing fastrpc_map_create() to control whether the lookup should take a reference. For arguments beyond ctx->nbufs, the lookup is performed without taking a reference, ensuring that existing mappings are reused without introducing duplicate DMA mappings or reference count imbalance. Link: https://lore.kernel.org/all/20260625080832.17477-1-jianping.li@oss.qualcomm.com/ Fixes: 10df039834f84 ("misc: fastrpc: Skip reference for DMA handles") Cc: stable@kernel.org Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index d110b69454eef..70ced857ce030 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -992,9 +992,9 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, } static int fastrpc_map_create(struct fastrpc_user *fl, int fd, - u64 len, u32 attr, struct fastrpc_map **ppmap) + u64 len, u32 attr, struct fastrpc_map **ppmap, bool take_ref) { - if (!fastrpc_map_lookup(fl, fd, ppmap, true)) + if (!fastrpc_map_lookup(fl, fd, ppmap, take_ref)) return 0; return fastrpc_map_attach(fl, fd, len, attr, ppmap); @@ -1068,23 +1068,23 @@ static int fastrpc_create_maps(struct fastrpc_invoke_ctx *ctx) int i, err; for (i = 0; i < ctx->nscalars; ++i) { + bool take_ref = true; if (ctx->args[i].fd == 0 || ctx->args[i].fd == -1 || ctx->args[i].length == 0) continue; - if (i < ctx->nbufs) - err = fastrpc_map_create(ctx->fl, ctx->args[i].fd, - ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); - else - err = fastrpc_map_attach(ctx->fl, ctx->args[i].fd, - ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); + if (i >= ctx->nbufs) + take_ref = false; + + err = fastrpc_map_create(ctx->fl, ctx->args[i].fd, ctx->args[i].length, + ctx->args[i].attr, &ctx->maps[i], take_ref); if (err) { dev_err(dev, "Error Creating map %d\n", err); return -EINVAL; } - } + return 0; } @@ -1613,7 +1613,7 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl, fl->pd = USER_PD; if (init.filelen && init.filefd) { - err = fastrpc_map_create(fl, init.filefd, init.filelen, 0, &map); + err = fastrpc_map_create(fl, init.filefd, init.filelen, 0, &map, true); if (err) goto err; } @@ -2240,7 +2240,7 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp) return -EFAULT; /* create SMMU mapping */ - err = fastrpc_map_create(fl, req.fd, req.length, 0, &map); + err = fastrpc_map_create(fl, req.fd, req.length, 0, &map, true); if (err) { dev_err(dev, "failed to map buffer, fd = %d\n", req.fd); return err;