From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f47.google.com (mail-ed1-f47.google.com [209.85.208.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFB393B95E9 for ; Mon, 13 Apr 2026 15:13:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776093241; cv=none; b=isTCxDNsgto82ifLQnjC5FrEpLw+i31joXPg3LdKMF3p/1uAxO5iKvSFEVRsQLbEw/WL6itNibfavzVHfU93Wv6jlbqnuO3OEeA8wFkf26Ws2ohyju/EWft9W/+ltkx9qnMt2O6/fv+TgodtYDECWpSE3GTvTuaj7o8uW8jBTZU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776093241; c=relaxed/simple; bh=6QZ4ZaXoQuBr7I3bFSF1x+T8RNR/5xQptlZ4rTb1K8Y=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Rtmu14Zmj49wpFecL0B/2U8t+MyyJPuj6NnYc6KB5h/JneLWYBEwxk3ZYUwp6awSxs+rIDLHu3ZwJCEswgZUPbXjyy2ajVgmQPVthn0GJwtFspt8wUgKbhOfybd+IsDBXt/Kv8y3WZNVDBC4ktpNfhgFUWRAnEMbwe7j2BJ8KUo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ON/s3n5i; arc=none smtp.client-ip=209.85.208.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ON/s3n5i" Received: by mail-ed1-f47.google.com with SMTP id 4fb4d7f45d1cf-66e129e457dso4560031a12.1 for ; Mon, 13 Apr 2026 08:13:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776093238; x=1776698038; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=lLzdCqWaPSJ0EWisHYLtQ/C3+FmYmzzVJRGOCC4Ipm4=; b=ON/s3n5iEWWN8mNibWlal0UyW0OwmKuAiNu8uKi1BLp/bt1hcTR4drgM5UeX0rfGV6 +SJOF4EWIeZUXwWQntg9x98i7YPdKWsa5SQ4LgsFSRzpu1AFW0TXe81lzlMMzaQrHJGP fNqHGsc3SXneijHWaB7YzSK3CC/sTREAE/k9mQUzEHge/GRDLXK7NtARRppEpi4g1hK0 UIYVOW6Ibj2N1e417EDBuwDRk2RgnIHUxRhiDzX6Y3/fv24EVaWkouaQ9Ae5Yr98cYDy Ylo9E46yyAiEfwi3OGhK1TAqUPcbib6uTMzHxCpXu6pJMe9rATmyEYCq9tFrJZ+St8gS uKZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776093238; x=1776698038; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=lLzdCqWaPSJ0EWisHYLtQ/C3+FmYmzzVJRGOCC4Ipm4=; b=dV+v2yTv/wwCJ4YjJqDS6fgDGhfUlOVpakTV0ypMCBNzwUfChzMcOxbe7HW7NsE6QH mEkplfsASJUlzseBRbvAAvVprnYthNrnX7xWlLN07gNYdwT88Wlbzn0LrnP4m+to3Rm4 8yVPMRJMt+6/G9ZhBa2FTcNWo11YV0e2ZVNXaBNsS+xW+eH4zxvLXV/XvzOKyVuy6oSa t4n90LbaWj8rznDrtqf8zilbRHIAjqn/6CmytpGaWx6Q48ZC6qGmFph1SpM35quIJeyY 2vWcgVcSY6M1h8bsJ0gV9u2nJPgg8AGw5WRcQ1my9RtJFdqeSp1F1Kny+p+kIjuMWLVY B2yg== X-Forwarded-Encrypted: i=1; AFNElJ803x3qnFzKccNgCfR7ATNi0ir5Pz+eK26GtFuUfsDuttcMHG2AhBI8liXKCwbrBVTPJ7inMKhkg9NmDnI=@vger.kernel.org X-Gm-Message-State: AOJu0Yw06QB1UDjyVByKjZo+6y9DynixemmRAIynPZCPheMUKv42+SFt GiHRCvwd4DgbVzNYXKYLELDTNW0O1uQ+q5OcY8wowRWsahzMxl6osBx4 X-Gm-Gg: AeBDieuM4TZppU+vza+BePZIT6PgOuPVpKT7qbpuOX5M+i2tbsBb/TfHoLvNz+csfQX h4H3JZ6e3Gfwyv/34yfVN59UiW9D1CtnmCepTKuA8NR3SncY+bLFpFDXkvg+/VFepdM5NQgiXvo 2Pi5CmoQmFQI/1egRAXVHECIXAjsIt4eGnEuB/wQTMWXF3O/lSujr1BIee+gy6SmD+AG4VY33XG BpwNEYhv4ot+DRj+FKXbvnZjAYk236GqEVGzqwADfyIXzNV7ETSeOEEodbCPuYav5bCp8xjoPHb F5qFqSa36MVORpvBs7rMcvu2kQ99cgDM405tqVYV+3UWdSjgTJs1s6C4aOHgN7xI/SSfSWw1hxr cUg4ysTLNdj+/a9fbssyWaa4CF8OIMaihNTKT2BYO9pnNhwfEDsfI+dJ3c2dXdNRubzyj2Bebtd QPBlJUPVpUFBqgtenIaUP34W/wKmGx/oXpySk2KIPXprkqiQep+4nCfYn0TgwMnUjFK7mIvgPIU ujwRJOYN152zmB7AojCcWic2KWh9IEqSozwZM9CO1hMzIFwZ/BVO3WP3o56pe68uAbcvtL8leP+ sm2pHA== X-Received: by 2002:a05:6402:5188:b0:670:a3f1:a56b with SMTP id 4fb4d7f45d1cf-670a3f1a87emr6294857a12.5.1776093237743; Mon, 13 Apr 2026 08:13:57 -0700 (PDT) Received: from ahossu.residents.sin.openfiber.nl ([88.202.160.248]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-671c4f6049bsm39047a12.13.2026.04.13.08.13.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Apr 2026 08:13:56 -0700 (PDT) From: Alexandru Hossu To: gregkh@linuxfoundation.org Cc: linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, error27@gmail.com, Alexandru Hossu Subject: [PATCH v2 1/2] staging: nvec: fix use-after-free in nvec_rx_completed() Date: Mon, 13 Apr 2026 17:12:29 +0200 Message-ID: <20260413151229.612301-1-hossu.alexandru@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check. Fixes: d6bdcf2e1019 ("staging: nvec: Add battery quirk to ignore incomplete responses") Reviewed-by: Dan Carpenter Signed-off-by: Alexandru Hossu --- v2: - Add Fixes tag (Dan Carpenter) - Remove obvious comment (Dan Carpenter) - Move declaration to start of block (Dan Carpenter) drivers/staging/nvec/nvec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c index 952c5a849a56..2a3499dd4d63 100644 --- a/drivers/staging/nvec/nvec.c +++ b/drivers/staging/nvec/nvec.c @@ -494,6 +494,8 @@ static void nvec_tx_completed(struct nvec_chip *nvec) static void nvec_rx_completed(struct nvec_chip *nvec) { if (nvec->rx->pos != nvec_msg_size(nvec->rx)) { + unsigned char msg_type = nvec->rx->data[0]; + dev_err(nvec->dev, "RX incomplete: Expected %u bytes, got %u\n", (uint)nvec_msg_size(nvec->rx), (uint)nvec->rx->pos); @@ -502,7 +504,7 @@ static void nvec_rx_completed(struct nvec_chip *nvec) nvec->state = 0; /* Battery quirk - Often incomplete, and likes to crash */ - if (nvec->rx->data[0] == NVEC_BAT) + if (msg_type == NVEC_BAT) complete(&nvec->ec_transfer); return; -- 2.53.0