misc: fastrpc: avoid duplicate DMA mappings in fastrpc_create_maps()#1437
misc: fastrpc: avoid duplicate DMA mappings in fastrpc_create_maps()#1437Jianping (Jianping-Li) wants to merge 1 commit into
Conversation
…te_maps() fastrpc_create_maps() performs map lookup only for buffer arguments (i < ctx->nbufs) via fastrpc_map_create(). For arguments beyond this range, no lookup is performed, which can result in duplicate DMA mappings for the same file descriptor. Additionally, if the same file descriptor is passed multiple times within a single invocation, performing lookups with reference counting would increment the reference multiple times, while fastrpc_put_args() would release it only once, leading to an imbalanced reference count. Fix this by allowing fastrpc_map_create() to control whether the lookup should take a reference. For arguments beyond ctx->nbufs, the lookup is performed without taking a reference, ensuring that existing mappings are reused without introducing duplicate DMA mappings or reference count imbalance. Link: https://lore.kernel.org/all/20260625080832.17477-1-jianping.li@oss.qualcomm.com/ Fixes: 10df039 ("misc: fastrpc: Skip reference for DMA handles") Cc: stable@kernel.org Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
🔨 Build Failure Analysis — PR #1437PR: #1437
VerdictThis is not a compilation failure. The build failed during the integration/automerge phase due to merge conflicts between this PR and other topic branches. The PR changes to 📎 Detailed analysis: Full report |
🔨 Build Failure Analysis — PR #1437PR: #1437
VerdictThis is NOT a build failure caused by the PR. The failure occurred during the merge phase of the CI workflow when attempting to integrate the PR branch with the baseline integration branch. The merge conflicts in 📎 Detailed analysis: Full report |
PR #1437 — validate-patchPR: #1437
Final Summary
|
PR #1437 — checker-log-analyzerPR: #1437
Detailed report: Full report
|
fastrpc_create_maps() performs map lookup only for buffer arguments (i < ctx->nbufs) via fastrpc_map_create(). For
arguments beyond this range, no lookup is performed, which can result in duplicate DMA mappings for the same file descriptor.
Additionally, if the same file descriptor is passed multiple times within a single invocation, performing lookups with
reference counting would increment the reference multiple times, while fastrpc_put_args() would release it only once,
leading to an imbalanced reference count.
Fix this by allowing fastrpc_map_create() to control whether the lookup should take a reference. For arguments beyond
ctx->nbufs, the lookup is performed without taking a reference, ensuring that existing mappings are reused without introducing duplicate DMA mappings or reference count imbalance.
CRs-Fixed: 4490320