On 24-06-2026 23:16, Yousef Alhouseen wrote: > FASTRPC_IOCTL_MUNMAP looked up a buffer and dropped fl->lock. > > It only deleted the list entry after the remote unmap succeeded. > > Two threads can therefore find the same entry and unmap it twice. > > That can lead to a double list deletion and double free. > > Detach the entry before invoking the DSP. > > Put it back if the remote unmap fails. > There was a fix that got recently merged to fix the same problem[1].
Please check it and let me know if your change still holds. [1] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/drivers/misc/fastrpc.c?id=902b8ec9dd1098cc133cffa8be0b6378544f27ba //ekansh> Signed-off-by: Yousef Alhouseen <[email protected]> > --- > drivers/misc/fastrpc.c | 14 ++++++++++++-- > 1 file changed, 12 insertions(+), 2 deletions(-) > > diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c > index ba4ade874..6a5239b1c 100644 > --- a/drivers/misc/fastrpc.c > +++ b/drivers/misc/fastrpc.c > @@ -1902,7 +1902,8 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user > *fl, struct fastrpc_buf * > if (!err) { > dev_dbg(dev, "unmmap\tpt 0x%09lx OK\n", buf->raddr); > spin_lock(&fl->lock); > - list_del(&buf->node); > + if (!list_empty(&buf->node)) > + list_del_init(&buf->node); > spin_unlock(&fl->lock); > fastrpc_buf_free(buf); > } else { > @@ -1917,6 +1918,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, > char __user *argp) > struct fastrpc_buf *buf = NULL, *iter, *b; > struct fastrpc_req_munmap req; > struct device *dev = fl->sctx->dev; > + int err; > > if (copy_from_user(&req, argp, sizeof(req))) > return -EFAULT; > @@ -1925,6 +1927,7 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, > char __user *argp) > list_for_each_entry_safe(iter, b, &fl->mmaps, node) { > if ((iter->raddr == req.vaddrout) && (iter->size == req.size)) { > buf = iter; > + list_del_init(&buf->node); > break; > } > } > @@ -1936,7 +1939,14 @@ static int fastrpc_req_munmap(struct fastrpc_user *fl, > char __user *argp) > return -EINVAL; > } > > - return fastrpc_req_munmap_impl(fl, buf); > + err = fastrpc_req_munmap_impl(fl, buf); > + if (err) { > + spin_lock(&fl->lock); > + list_add_tail(&buf->node, &fl->mmaps); > + spin_unlock(&fl->lock); > + } > + > + return err; > } > > static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp)
