From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f48.google.com (mail-ej1-f48.google.com [209.85.218.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D6CC37F750 for ; Sun, 12 Apr 2026 20:52:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776027168; cv=none; b=GV+/skMKVxfy0/oQ5Nwb61M4ERDnNG0CTW3osO/6kegaiaRyO++rkcD4Rxw8DnnMLZlKdGCcJRkXXhEilUnUZTLvTEOdc6Fa8OvkQB/4lnRgialNmUnugeqxQt7APZgalrJpVXc7c+xO78I8gj5dElskSVc/PNGGSo4S1T4J/Qk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776027168; c=relaxed/simple; bh=PT3xs71fHd+54WioIwbDh1RrwxMQVhrEdhvCl0wP16c=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nG+Gze9TvqlsHBcTfJcRBHXDLh+qDEpDEDphZIq8dXFvrPVmbUiyIb42IcH4VP6Xj8PwH4U/eNdnLNvk7Bic90hRB8df4hP3ZQOI6DnifJwqQZOsn9C3JaLGZNLVagM8Az9ecZQyyWvjtrpXmmOiUADQQZQJF0tPkBRoHA8m50c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=sTQhSVU/; arc=none smtp.client-ip=209.85.218.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="sTQhSVU/" Received: by mail-ej1-f48.google.com with SMTP id a640c23a62f3a-b93698bb57aso669943766b.0 for ; Sun, 12 Apr 2026 13:52:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776027166; x=1776631966; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=NmfBAQ0D3Sa5sjeFp529b93qLEW05p6njf5APTbVpD8=; b=sTQhSVU/IH83hnoGF0DodvRW+6ZsHGHWekDo0X1WpRCJYtf3Kht5EUpJL/2DLA3n6U u50zP2rwJAPsnkz5kpguCeyHHj4BF4XIp6U5qN1VdXK0IjJLIViOAZb6o2SHVZuztwvM A8IJ7QY/cy8U4uFV+sx3GJKum/oBmASwBaZqglNiF/WfluOS2ChjhDShVNVWLVgrux85 3kE6sQjHQ19ocgX49fCf0ra0bUJKz+sgn0nm+SMP8BwW8V5tfQTx70QwHs1+f760zrug Y/Mv3Gr2My4K7X9B7seD72QCr03tNJPEeTPzwJqfenGiwD0iIz/0GWgMKpbL7HSy9/1Z EcqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776027166; x=1776631966; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=NmfBAQ0D3Sa5sjeFp529b93qLEW05p6njf5APTbVpD8=; b=eljtVrXsHWnmJrgHIA0scQ9JBQgxzglo92cWGPNoyLimg1JfGsFXlTUMW1EIlw+i3U lJt8ydVzmwIF5LdJNTG+/YKkt1bGBe3Gs7R0LeaiOC5cs/DKdl8uWGttvwPrywM/4vRS XMn9nUw1a40VplMo9RJtAEfQ3LQk8ScUMifsYM3QhuoJysBZl1X8ry/+87VeswikcP8+ yFZ2NZaqQErCwqyMFXtmbkS8qUTasc+RJKoa/ggqYC4Ea6Wj8YX4zwCJhp7aeGAgN9S4 dgBfrJ3osmMmAj39H7kkRwqpEt0+ghD25P1cFBOiLKp5wNGoWfgyC+3Z5Lf3Q17S1D18 T8wA== X-Forwarded-Encrypted: i=1; AFNElJ99+tiWzbM9uamBTtaAMJVYQEtoHw4qUjpYEJoWEmCR3gMZModxzlrp88ESD3iysHLeofxtUeEtRGEcdQs=@vger.kernel.org X-Gm-Message-State: AOJu0YxEBwosC2B8jxAXIh/RAcBPI+kYW+6Wsmt3wJ34IWJ5SOSSYQGX JxpuhKwDSwgpXxzQELparEDFSLl4ObBj5kgB/HFdbnYve8fxz/cri2vk X-Gm-Gg: AeBDieti0XaE4WqS/JabYAZyGsI/qLSHzxIbyxJr4GsY/IEt+vwzVV+tRgQ/jgSA2ef I2KZsid+fi2vzvWtWMwCAcCOivPmhdlqkazNqFGyo9KeL3MvfpHJaQaYnWXVm9lgvVujV188Tll hBu9zZk7Hb5yKgQVAEd1gWOf/KVonBlx9os88+Gt+0lNcZuNrcAR4ulFc07JghD1gqqCcIaKKZ3 NJUJzWPDqy0IFQqUPlVmZP2sTDoAqJhDxiPvsRR++tiQJI2+fmiFwasMv7y8E9K6fy3ZIAOn12q OjGXs0KaGaz8m9vo8B9oYYlS86fOy69n4SI1Rine/czoqeiG2CaiyypEcHjh1R7mrTWOLjurb4d fLss8ehdGshZYPOfO7H8UlLck18TQoeUjVShzdXnEVB1o6JCKK9A1Bp86kxnAKFFqylXwZLbAYl R6r3eJOqqT0QCANpi/S5Pc0qJYoaswLECNiX6Jy8Mpvp9EcXn6HRaoNGjg32nsBrbTWoHy48ZLA tctnQoJRFGKYj1NV2gRP8qUcq4bbZJbn78NturdMcC/LzyGX9AYgIhQynlrayjTUzQGUJ1rwCUo s/RDaCpeVQk3xAm2 X-Received: by 2002:a17:907:1b22:b0:b97:fec5:eced with SMTP id a640c23a62f3a-b9d45b64482mr763764166b.0.1776027165602; Sun, 12 Apr 2026 13:52:45 -0700 (PDT) Received: from ahossu.residents.sin.openfiber.nl ([88.202.160.248]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b9d6dfd78f6sm263126266b.26.2026.04.12.13.52.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Apr 2026 13:52:44 -0700 (PDT) From: Alexandru Hossu To: linux-tegra@vger.kernel.org Cc: marvin24@gmx.de, gregkh@linuxfoundation.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Alexandru Hossu Subject: [PATCH 3/5] staging: nvec: fix use-after-free in nvec_rx_completed() Date: Sun, 12 Apr 2026 22:51:16 +0200 Message-ID: <20260412205117.387125-1-hossu.alexandru@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check. Signed-off-by: Alexandru Hossu --- drivers/staging/nvec/nvec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c index 952c5a849a56..75877038847f 100644 --- a/drivers/staging/nvec/nvec.c +++ b/drivers/staging/nvec/nvec.c @@ -498,11 +498,14 @@ static void nvec_rx_completed(struct nvec_chip *nvec) (uint)nvec_msg_size(nvec->rx), (uint)nvec->rx->pos); + /* Save before freeing to avoid use-after-free */ + unsigned char msg_type = nvec->rx->data[0]; + nvec_msg_free(nvec, nvec->rx); nvec->state = 0; /* Battery quirk - Often incomplete, and likes to crash */ - if (nvec->rx->data[0] == NVEC_BAT) + if (msg_type == NVEC_BAT) complete(&nvec->ec_transfer); return; -- 2.53.0