[PATCH] rapidio: mport_cdev: fix use-after-free in mport_mm_close()

[PATCH] rapidio: mport_cdev: fix use-after-free in mport_mm_close()

[James Kim]

A use-after-free vulnerability was identified in mport_mm_close() in
drivers/rapidio/devices/rio_mport_cdev.c, identical to the pattern
previously addressed in dma_req_free().

This is observable from userspace when an application creates an mmap
mapping via the RapidIO character device and subsequently unmaps it
(or terminates, triggering exit_mmap()). During munmap, mport_mm_close()
is invoked and drops the mapping reference via kref_put().

If kref_put() drops the last reference, mport_release_mapping() is called,
which frees the underlying rio_mport_mapping structure. The subsequent
mutex_unlock() then dereferences map->md to unlock buf_mutex, leading to
a use-after-free:

   mport_mm_close()
     -> mutex_lock(&map->md->buf_mutex);
     ...
     -> kref_put(&map->ref, mport_release_mapping); /* map is freed */
     -> mutex_unlock(&map->md->buf_mutex);          /* UAF: map used */

Fix this by caching map->md before kref_put() and using the cached
pointer for mutex unlocking, ensuring that freed memory is not accessed.

Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Cc: stable@vger.kernel.org
Signed-off-by: James Kim <james010kim@gmail.com>
---
Note for Andrew:
Following up on the Sashiko review results you shared in the dma_req_free()
thread (https://sashiko.dev/#/patchset/20260615070530.371640-1-james010kim@gmail.com),
I audited the reported pre-existing flaws and verified that this UAF in
mport_mm_close() is a genuine bug with the identical locking pattern.

 drivers/rapidio/devices/rio_mport_cdev.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index ad82c2108a56..47ba34b4afb2 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -2167,11 +2167,12 @@ static void mport_mm_open(struct vm_area_struct *vma)
 static void mport_mm_close(struct vm_area_struct *vma)
 {
 	struct rio_mport_mapping *map = vma->vm_private_data;
+	struct mport_dev *md = map->md;
 
 	rmcd_debug(MMAP, "%pad", &map->phys_addr);
-	mutex_lock(&map->md->buf_mutex);
+	mutex_lock(&md->buf_mutex);
 	kref_put(&map->ref, mport_release_mapping);
-	mutex_unlock(&map->md->buf_mutex);
+	mutex_unlock(&md->buf_mutex);
 }
 
 static const struct vm_operations_struct vm_ops = {
-- 
2.43.0

Re: [PATCH] rapidio: mport_cdev: fix use-after-free in mport_mm_close()

[Andrew Morton]

On Mon, 14 Sep 2026 13:23:27 +0900 James Kim <james010kim@gmail.com> wrote:

> A use-after-free vulnerability was identified in mport_mm_close() in
> drivers/rapidio/devices/rio_mport_cdev.c, identical to the pattern
> previously addressed in dma_req_free().
> 
> This is observable from userspace when an application creates an mmap
> mapping via the RapidIO character device and subsequently unmaps it
> (or terminates, triggering exit_mmap()). During munmap, mport_mm_close()
> is invoked and drops the mapping reference via kref_put().
> 
> If kref_put() drops the last reference, mport_release_mapping() is called,
> which frees the underlying rio_mport_mapping structure. The subsequent
> mutex_unlock() then dereferences map->md to unlock buf_mutex, leading to
> a use-after-free:
> 
>    mport_mm_close()
>      -> mutex_lock(&map->md->buf_mutex);
>      ...
>      -> kref_put(&map->ref, mport_release_mapping); /* map is freed */
>      -> mutex_unlock(&map->md->buf_mutex);          /* UAF: map used */
> 
> Fix this by caching map->md before kref_put() and using the cached
> pointer for mutex unlocking, ensuring that freed memory is not accessed.
> 

Thanks.

> Note for Andrew:
> Following up on the Sashiko review results you shared in the dma_req_free()
> thread (https://sashiko.dev/#/patchset/20260615070530.371640-1-james010kim@gmail.com),
> I audited the reported pre-existing flaws and verified that this UAF in
> mport_mm_close() is a genuine bug with the identical locking pattern.
> 

Thanks again.

Sashiko blew another fuse over the rapidio driver:

	https://sashiko.dev/#/patchset/20260914042327.49798-1-james010kim@gmail.com