kernel/git/next/linux-next.git/drivers/misc/fastrpc.c, branch master

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/srini/fastrpc.git

2026-09-14T14:22:12+00:00

Merge branches 'fastrpc-fixes' and 'fastrpc-for-7.4' into fastrpc-for-next

2026-09-14T09:07:08+00:00

* fastrpc-fixes: misc: fastrpc: Allocate entire reserved memory for Audio PD in probe misc: fastrpc: fix double-free in fastrpc_map_attach() error path * fastrpc-for-7.4: misc: fastrpc: Use devm_of_reserved_mem_device_init() misc: fastrpc: Reduce console noise from expected DSP info, reserved memory and session messages

misc: fastrpc: Use devm_of_reserved_mem_device_init()

2026-09-14T08:11:24+00:00

Use the devres-managed devm_of_reserved_mem_device_init() to ensure the reserved memory region is released on device removal, fixing a missing of_reserved_mem_device_release() in fastrpc_rpmsg_remove(). Reviewed-by: Ekansh Gupta Signed-off-by: Mukesh Ojha Reviewed-by: Konrad Dybcio Signed-off-by: Srinivas Kandagatla

misc: fastrpc: Reduce console noise from expected DSP info, reserved memory and session messages

2026-09-14T08:09:49+00:00

On some platforms the DSP firmware does not support the fastrpc capability/attribute query. The DSP side returns an error (err: -1) while handling the request, so fastrpc_get_info_from_dsp() does not return DSP_UNSUPPORTED_API but a generic error, and the "else if (err)" branch in fastrpc_get_info_from_kernel() is taken. cctx->valid_attributes is therefore never set and every open()/query re-prints the same "dsp information is incorrect" line. This is not tied to boot timing: it can be reproduced at any time by manually starting adsprpcd. On RC builds with metadata flashing enabled several clients come up and flood the console. As this is an expected, platform-specific and non-fatal condition, downgrade the message to dev_dbg. Similarly, the absence of reserved DMA memory is a valid configuration and does not indicate an error, so downgrade that message to dev_dbg as well. Also rate-limit the "No session available" message with dev_err_ratelimited(): it reflects a genuine failure (open() returns -EBUSY) so it should still be visible, but must not flood dmesg when the session pool is exhausted. No functional change intended. Signed-off-by: Jianping Li Link: https://lore.kernel.org/all/20260514062825.50172-1-jianping.li@oss.qualcomm.com/ Signed-off-by: Srinivas Kandagatla

misc: fastrpc: Allocate entire reserved memory for Audio PD in probe

2026-09-14T08:03:52+00:00

Allocating and freeing Audio PD memory from userspace is unsafe because the kernel cannot reliably determine when the DSP has finished using the memory. Userspace may free buffers while they are still in use by the DSP, and remote free requests cannot be safely trusted. Additionally, the current implementation allows userspace to repeatedly grow the Audio PD heap, but does not support shrinking it. This can lead to unbounded memory usage over time, effectively causing a memory leak. Fix this by allocating the entire Audio PD reserved-memory region during rpmsg probe and tying its lifetime to the rpmsg channel. This removes userspace-controlled alloc/free and ensures that memory is reclaimed only when the DSP process is torn down. The reserved-memory region is now mandatory for the Audio PD domain. Rather than failing rpmsg probe when it is missing, validate it in fastrpc_init_create_static_process() and reject only the static-process creation. This keeps the fastrpc device probing for all other domains even on a misconfigured device tree. Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") Cc: stable@kernel.org Signed-off-by: Jianping Li Reviewed-by: Ekansh Gupta Link: https://lore.kernel.org/all/20260814101955.234238-1-jianping.li@oss.qualcomm.com/ Signed-off-by: Srinivas Kandagatla

misc: fastrpc: fix double-free in fastrpc_map_attach() error path

2026-09-14T08:00:03+00:00

map->table is assigned right after dma_buf_map_attachment_unlocked() succeeds. The two failure checks that follow, the len > map->size test and, where subsystem VMIDs are configured, a failed qcom_scm_assign_mem(), jump to map_err with map->table already set. map_err manually calls dma_buf_detach() and dma_buf_put() and then falls through to fastrpc_map_put(). Since that change the error path tail is fastrpc_map_put() -> fastrpc_free_map(), and fastrpc_free_map() already unmaps, detaches and puts the dma-buf whenever map->table is set. The two operations therefore run twice: the second dma_buf_put() drops an extra reference on map->buf, and dma_buf_unmap_attachment_unlocked() dereferences the map->attach already freed by the manual dma_buf_detach(). kref_init() sets the refcount to 1 with no intervening get, so the final fastrpc_map_put() frees the map synchronously and the redundant cleanup is deterministic. The len > map->size branch is reachable by an unprivileged process via FASTRPC_IOCTL_MEM_MAP with an fd whose dma-buf is smaller than the requested length, before any DSP invocation. Route both map->table-is-set failure branches to get_err instead of map_err, so fastrpc_free_map() is the single owner of the unmap/detach/put sequence. map_err is retained for the dma_buf_map_attachment_unlocked() failure, which is reached with map->table still NULL and an attachment that fastrpc_free_map() will not clean up, so its dma_buf_detach()/dma_buf_put() must still run manually. Fixes: 334f1a1cbe03 ("misc: fastrpc: Use fastrpc_map_put in fastrpc_map_create on fail") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Yifei Gao Reviewed-by: Ekansh Gupta Signed-off-by: Srinivas Kandagatla

Merge drm/drm-fixes into drm-misc-fixes

2026-09-01T07:38:51+00:00

Let's start the 7.3 drm-misc-fixes cycle. Signed-off-by: Maxime Ripard

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-08-25T16:38:50+00:00

Pull char/misc/IIO/etc driver updates from Greg KH: "Here is the big set of char, misc, iio, counter, fpga, and other small driver subsystems for 7.3-rc1. Overall, due to some driver removals we only added a bit more code than removed, which was a nice change. Highlights in this merge request are: - Loads of IIO driver updates and additions - binder driver updates (more on that below...) - Removal of the SGI XP and GRU drivers as they are not used anymore and turn out to be pretty insecure overall - Removal of the obsolete ibmasm driver as it's not being used anymore - Coresight driver updates and additions - Mei driver udpates - Counter driver updates - FPGA driver updates - ICC driver updates - lots and lots of other tiny driver updates to resolve reported issues All of these have been in linux-next for a while" * tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits) iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF iio: adc: pac1921: fix wrong channel used in trigger handler read iio: light: gp2ap002: re-enable irq if runtime suspend fails iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes iio: light: apds9306: fix PM reference leak in apds9306_read_data() iio: gyro: mpu3050: fix sign of raw angular velocity readings iio: srf04: fix pm_runtime handling on probe error path iio: adc: ad4080: configure backend data size iio: adc: adi-axi-adc: add data size support for AD408X backend iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable iio: dac: ad5446: fix OF module device table iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask iio: light: opt4001: Reject integration times with a non-zero seconds part iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() iio: light: opt4001: Fix power down clearing bits of the wrong register iio: light: opt4060: Fix incorrect register name in threshold read error message iio: light: opt4060: Fix pointer type passed to div_u64_rem() iio: light: opt4060: Reject integration times with a non-zero seconds part iio: light: ltrf216a: fix runtime PM reference leak in error path iio: pressure: dps310: fix NULL pointer dereference on ACPI probe ...

misc: fastrpc: don't publish fd before copy_to_user() succeeds

2026-08-24T11:58:25+00:00

fastrpc_ioctl_alloc_dmabuf() calls dma_buf_fd() which installs the fd into the caller's fd table before copy_to_user() copies the fd number back to userspace. If copy_to_user() fails, the fd is already visible to other threads in the same process but the ioctl returns -EFAULT. The existing comment in the code even acknowledges the problem: "The usercopy failed, but we can't do much about it, as dma_buf_fd() already called fd_install()..." Now that dma_buf_fd_install() is available (introduced to fix the same issue in dma-heap), apply the same pattern here: reserve the fd with get_unused_fd_flags(), attempt copy_to_user(), and only on success call dma_buf_fd_install() to publish it atomically with the tracepoint. On copy_to_user() failure, put_unused_fd() and dma_buf_put() cleanly unwind without any user-visible side effects. Fixes: 6cffd79504ce ("misc: fastrpc: Add support for dmabuf exporter") Cc: stable@vger.kernel.org Acked-by: Christian König Acked-by: Sumit Semwal Signed-off-by: Baineng Shou Link: https://lore.kernel.org/r/20260817050457.1005285-3-shoubaineng@gmail.com Signed-off-by: Christian König

misc: Unify style of of_device_id arrays

2026-07-31T12:20:50+00:00

Update the various of_device_id arrays to conform to the most used and generally recommended coding style. That is: - No comma after the list terminator; - A comma after an initializer if (and only if) the closing } is not directly following; - No explicit zeros in the list terminator; - A space after an opening { and before a closing }, a single space in the list terminator; Adapt the few offenders accordingly. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Romain Gantois Link: https://patch.msgid.link/fbf51b8f413c516977e2c8a81896221795df77e4.1784299069.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman