From patchwork Fri Aug 23 10:06:21 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Srinivas Kandagatla X-Patchwork-Id: 172103 Delivered-To: patch@linaro.org Received: by 2002:a92:d204:0:0:0:0:0 with SMTP id y4csp427655ily; Fri, 23 Aug 2019 03:07:06 -0700 (PDT) X-Google-Smtp-Source: APXvYqw5DlYh5Yoni+PxLBNas6NME8/DHO+tlVyQkCpv92vTXHuhOO1xJsXVFMtdj+Bk4nWUgiwN X-Received: by 2002:a17:902:b604:: with SMTP id b4mr3734832pls.94.1566554826163; Fri, 23 Aug 2019 03:07:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1566554826; cv=none; d=google.com; s=arc-20160816; b=coz7Uh6MKKaofNx6jC7NNati34PWNFB9hfL+pTrHZn2CAvbkHKB4Ngvt0cB1j/c5uV 46pam8xw6ZsxODzqrytaxNNbA+6/7pkw+tBoSCz2Aa7PHkNlSOAx/zzBmf8Zc+9Te5hw Iuo/ytb09UPJAHVUctg7wkXUFvfS0WWT819QalZt1GBz1+2JEfMw4OWi4x9kEJPu4SKl j8jjaHgPf12xEfUwlGOoVabb29R6eiWBuA1S9xSIej9llBeeCzzTbKfrDiHRpaIQRoj7 hflLVhJS5HKSM3qqTikWWsaqzXBfuZ1u71SZWGE2GQWXZ+lZun1prp21OexqWUJbuXSV GUMA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=4bn9fvz5KyheuCTcqtCUPe7LWgeQB+vBp0zLz7BbKyg=; b=QivbO5p28KHK5i1+m5GHxk9iff+cHeIHJ66UhRMa+Wm1LAlCH4IwE54WbEKFr1r5GX 1RjHacRFB7y2LP5pT6lZuvUVqqGafDXEtCUVKekl7EjfipGUiJNxtvtwfG86kY5ZmgZj aT4ncI485VajTO/13mka1mttfvXtTKNZOrihrQzVdSzmJiwh/ln5W/4vqbNoMTb+VLPQ 2Lvpo0DYA/lQrKRW/ifEL3iZGpKnTF9GlBeuLRNa9yWPc4PX5cy4wAerSxuh6cTq6b/b Wjq76LOBmhaT6UzeLEE5tV/EY5B6MclbQ7xFo30vIAcRluYFiFJrTZWN5oX6mJV11zQz 8Kig== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=i8kWpNq1; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v11si2092269plg.31.2019.08.23.03.07.05; Fri, 23 Aug 2019 03:07:06 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=i8kWpNq1; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2392036AbfHWKHE (ORCPT + 28 others); Fri, 23 Aug 2019 06:07:04 -0400 Received: from mail-wm1-f66.google.com ([209.85.128.66]:55854 "EHLO mail-wm1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2391992AbfHWKHC (ORCPT ); Fri, 23 Aug 2019 06:07:02 -0400 Received: by mail-wm1-f66.google.com with SMTP id f72so8374227wmf.5 for ; Fri, 23 Aug 2019 03:07:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=4bn9fvz5KyheuCTcqtCUPe7LWgeQB+vBp0zLz7BbKyg=; b=i8kWpNq1BAp6nGlQ2U0mFfWA7MVPLqzBGVt+JqsdDMretmxZn7KIYxP6lIRF9g+BX8 2z2PyxyNrujPgUGIezcz3O+35GsB8jeSkw0a5mL+nF/2oxHBrr1VELcwRt6FePii4ISq pwlxw7UrQQiAyhOEo7cZwQTW3fKOcfvrv+EgnCPDQKt3Ddiu2mH1GHcfGHULfqgJz5qZ BVnkMhj5zHRVnvE7VhbXLFzYTHk33AtBoUO8c61xx3Y5J2dz/9RTbjKZKg+/YjP5epzx RV9QnA3mHRhAXuV2ZgfxVOoAovEnXYCGGREzg1MUnZ7LsK4KnGTi58ER4obOcFH6S4XE jsVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=4bn9fvz5KyheuCTcqtCUPe7LWgeQB+vBp0zLz7BbKyg=; b=HbLXo7usCWyUfHP7DFTJJUJHBfVGsNsTmUofHIZCUr5+8hy+HXyDVixHD2UsDiFGO1 qwMymIp/IabGsvRSg4RFBi0ajqFyg2F+zRJAzMMq//7v0SzK0ld0PfYLO8IUC0ugwmH4 JrddGeHmtupJLV/k8yVhqDH0ckMxlYwNExKiaf2Wynyox6fn+baiz+hlNWCLJ/Epm4aV 9kJWZRxv10MHUPvjAaIWi07xYckyUBWSfUjGzBN18xn2Kgflwuv5up0cRUTk0vyALXbG MsUlAwTjBJ8dhszU/SnKmV9G4wGCOdF+K5hmyb25McglW5ECKJD5QV0chBbpxavTu5m7 3s/w== X-Gm-Message-State: APjAAAVYVmqkm6rDpEaehp5x2PKepXV+TaxCslIxbHRD62PeWVME0pzi 9L3vr1LXwvcG5q2ZrVggN58yLg== X-Received: by 2002:a1c:7611:: with SMTP id r17mr4181366wmc.117.1566554820260; Fri, 23 Aug 2019 03:07:00 -0700 (PDT) Received: from srini-hackbox.lan (cpc89974-aztw32-2-0-cust43.18-1.cable.virginm.net. [86.30.250.44]) by smtp.gmail.com with ESMTPSA id q124sm2058048wma.33.2019.08.23.03.06.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 23 Aug 2019 03:06:59 -0700 (PDT) From: Srinivas Kandagatla To: gregkh@linuxfoundation.org Cc: arnd@arndb.de, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Srinivas Kandagatla , Mayank Chopra , Jorge Ramirez-Ortiz Subject: [PATCH 4/5] misc: fastrpc: fix double refcounting on dmabuf Date: Fri, 23 Aug 2019 11:06:21 +0100 Message-Id: <20190823100622.3892-5-srinivas.kandagatla@linaro.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190823100622.3892-1-srinivas.kandagatla@linaro.org> References: <20190823100622.3892-1-srinivas.kandagatla@linaro.org> MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org dma buf refcount has to be done by the driver which is going to use the fd. This driver already does refcount on the dmabuf fd if its actively using it but also does an additional refcounting via extra ioctl. This additional refcount can lead to memory leak in cases where the applications fail to call the ioctl to decrement the refcount. So remove this extra refcount in the ioctl More info of dma buf usage at drivers/dma-buf/dma-buf.c Reported-by: Mayank Chopra Reported-by: Jorge Ramirez-Ortiz Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 25 ------------------------- 1 file changed, 25 deletions(-) -- 2.21.0 diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 38829fa74f28..eee2bb398947 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1198,26 +1198,6 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp) return 0; } -static int fastrpc_dmabuf_free(struct fastrpc_user *fl, char __user *argp) -{ - struct dma_buf *buf; - int info; - - if (copy_from_user(&info, argp, sizeof(info))) - return -EFAULT; - - buf = dma_buf_get(info); - if (IS_ERR_OR_NULL(buf)) - return -EINVAL; - /* - * one for the last get and other for the ALLOC_DMA_BUFF ioctl - */ - dma_buf_put(buf); - dma_buf_put(buf); - - return 0; -} - static int fastrpc_dmabuf_alloc(struct fastrpc_user *fl, char __user *argp) { struct fastrpc_alloc_dma_buf bp; @@ -1253,8 +1233,6 @@ static int fastrpc_dmabuf_alloc(struct fastrpc_user *fl, char __user *argp) return -EFAULT; } - get_dma_buf(buf->dmabuf); - return 0; } @@ -1322,9 +1300,6 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd, case FASTRPC_IOCTL_INIT_CREATE: err = fastrpc_init_create_process(fl, argp); break; - case FASTRPC_IOCTL_FREE_DMA_BUFF: - err = fastrpc_dmabuf_free(fl, argp); - break; case FASTRPC_IOCTL_ALLOC_DMA_BUFF: err = fastrpc_dmabuf_alloc(fl, argp); break;