This is a note to let you know that I've just added the patch titled
misc: fastrpc: reject new invocations during device removal
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
misc-fastrpc-reject-new-invocations-during-device-removal.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 46248400d81e2aa0b65cd659d6f40188192a58b6 Mon Sep 17 00:00:00 2001
From: Richard Acayan <mailingradian@xxxxxxxxx>
Date: Tue, 23 May 2023 16:25:50 +0100
Subject: misc: fastrpc: reject new invocations during device removal
From: Richard Acayan <mailingradian@xxxxxxxxx>
commit 46248400d81e2aa0b65cd659d6f40188192a58b6 upstream.
The channel's rpmsg object allows new invocations to be made. After old
invocations are already interrupted, the driver shouldn't try to invoke
anymore. Invalidating the rpmsg at the end of the driver removal
function makes it easy to cause a race condition in userspace. Even
closing a file descriptor before the driver finishes its cleanup can
cause an invocation via fastrpc_release_current_dsp_process() and
subsequent timeout.
Invalidate the channel before the invocations are interrupted to make
sure that no invocations can be created to hang after the device closes.
Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable <stable@xxxxxxxxxx>
Signed-off-by: Richard Acayan <mailingradian@xxxxxxxxx>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20230523152550.438363-5-srinivas.kandagatla@xxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/misc/fastrpc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1497,7 +1497,9 @@ static void fastrpc_rpmsg_remove(struct
struct fastrpc_user *user;
unsigned long flags;
+ /* No invocations past this point */
spin_lock_irqsave(&cctx->lock, flags);
+ cctx->rpdev = NULL;
list_for_each_entry(user, &cctx->users, user)
fastrpc_notify_users(user);
spin_unlock_irqrestore(&cctx->lock, flags);
@@ -1505,7 +1507,6 @@ static void fastrpc_rpmsg_remove(struct
misc_deregister(&cctx->miscdev);
of_platform_depopulate(&rpdev->dev);
- cctx->rpdev = NULL;
fastrpc_channel_ctx_put(cctx);
}
Patches currently in stable-queue which might be from mailingradian@xxxxxxxxx are
queue-5.4/misc-fastrpc-reject-new-invocations-during-device-removal.patch
queue-5.4/misc-fastrpc-return-epipe-to-invocations-on-device-removal.patch
