misc: fastrpc: fix possible map leak in fastrpc_put_args

copy_to_user() failure would cause an early return without cleaning up
the fdlist, which has been updated by the DSP. This could lead to map
leak. Fix this by redirecting to a cleanup path on failure, ensuring
that all mapped buffers are properly released before returning.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable@kernel.org
Co-developed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ling Xu <quic_lxu5@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://lore.kernel.org/r/20250912131236.303102-4-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 1815b1e0c607def8caddfa5b1ed54da5414f417d..d950a179bff8c50aec91e80418245684885bb916 100644 (file)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1085,6 +1085,7 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx,
        struct fastrpc_phy_page *pages;
        u64 *fdlist;
        int i, inbufs, outbufs, handles;
+       int ret = 0;
 
        inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
        outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);
@@ -1100,14 +1101,17 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx,
                        u64 len = rpra[i].buf.len;
 
                        if (!kernel) {
-                               if (copy_to_user((void __user *)dst, src, len))
-                                       return -EFAULT;
+                               if (copy_to_user((void __user *)dst, src, len)) {
+                                       ret = -EFAULT;
+                                       goto cleanup_fdlist;
+                               }
                        } else {
                                memcpy(dst, src, len);
                        }
                }
        }
 
+cleanup_fdlist:
        /* Clean up fdlist which is updated by DSP */
        for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
                if (!fdlist[i])
@@ -1116,7 +1120,7 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx,
                        fastrpc_map_put(mmap);
        }
 
-       return 0;
+       return ret;
 }
 
 static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,