This is a note to let you know that I've just added the patch titled
misc: fastrpc: Reset metadata buffer to avoid incorrect free
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
misc-fastrpc-reset-metadata-buffer-to-avoid-incorrect-free.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 1c29d80134ac116e0196c7bad58a2121381b679c Mon Sep 17 00:00:00 2001
From: Ekansh Gupta <quic_ekangupt@xxxxxxxxxxx>
Date: Fri, 13 Oct 2023 13:20:04 +0100
Subject: misc: fastrpc: Reset metadata buffer to avoid incorrect free
From: Ekansh Gupta <quic_ekangupt@xxxxxxxxxxx>
commit 1c29d80134ac116e0196c7bad58a2121381b679c upstream.
Metadata buffer is allocated during get_args for any remote call.
This buffer carries buffers, fdlists and other payload information
for the call. If the buffer is not reset, put_args might find some
garbage FDs in the fdlist which might have an existing mapping in
the list. This could result in improper freeing of FD map when DSP
might still be using the buffer. Added change to reset the metadata
buffer after allocation.
Fixes: 8f6c1d8c4f0c ("misc: fastrpc: Add fdlist implementation")
Cc: stable <stable@xxxxxxxxxx>
Signed-off-by: Ekansh Gupta <quic_ekangupt@xxxxxxxxxxx>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20231013122007.174464-2-srinivas.kandagatla@xxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/misc/fastrpc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -903,6 +903,7 @@ static int fastrpc_get_args(u32 kernel,
if (err)
return err;
+ memset(ctx->buf->virt, 0, pkt_size);
rpra = ctx->buf->virt;
list = fastrpc_invoke_buf_start(rpra, ctx->nscalars);
pages = fastrpc_phy_page_start(list, ctx->nscalars);
Patches currently in stable-queue which might be from quic_ekangupt@xxxxxxxxxxx are
queue-6.1/misc-fastrpc-reset-metadata-buffer-to-avoid-incorrect-free.patch
queue-6.1/misc-fastrpc-unmap-only-if-buffer-is-unmapped-from-dsp.patch
queue-6.1/misc-fastrpc-clean-buffers-on-remote-invocation-failures.patch
queue-6.1/misc-fastrpc-free-dma-handles-for-rpc-calls-with-no-arguments.patch
