From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f46.google.com (mail-yx1-f46.google.com [74.125.224.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B48D35E1A8 for ; Wed, 22 Jul 2026 00:36:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=74.125.224.46 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784680609; cv=pass; b=CBVBTftBat9EL4cSxnrbTsRz9RHKhsw4Gcm5kIM+pQCbqUDxcLlgHvTCSHJsB4V5SPrD95GviPm76/D68q5WwnmXqZnOEf82O7h5nacphx8J6RR4Gqy4Ppfhxn+E0GG4vz7825hT5DcEapnivmthSbkODrqETHW1wvfCMPP7gns= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784680609; c=relaxed/simple; bh=VaOjMJW6yROXX2xcZF9AkpALiRyCECcvPnPYKFNeots=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=mmmpJehkxYUC0E8ucRL2Z2iGFNwZm9sBMTfyIGZ8p25gmfj6O1cxa2kPIDQmmdkIq+LELuDSc0a7f6fyrNpVUn9+l1JAQoQJe3xosWBHp4IvHJs9FumyJJAYWCXuDN62bIxy99dURKo/KljOFcgKXcGCHZ2gKs3S2co5htVO3YQ= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=rsV+j8tu; arc=pass smtp.client-ip=74.125.224.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="rsV+j8tu" Received: by mail-yx1-f46.google.com with SMTP id 956f58d0204a3-664db84f074so15205051d50.0 for ; Tue, 21 Jul 2026 17:36:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784680606; cv=none; d=google.com; s=arc-20260327; b=B5O6g2dlF1XIfo00tVoRrgLI8E8cVlgqAv+avS5p4jCm6g8wEZkK7zYL2u1e5jWODx eZRfGLS+DVIeNISAONRR5/S0qiwONrVSgZ6NAE8PzDo3n5zDC+FvgdY7Bfkq6YMU04+e dY9qukOLOp3JHImdE+ZqM2VvkrMewCTi9/9ghRtIEfV1nZyyDRFU7Na7T/EFFIQMOyI+ MzQIgWG71pyqPH4Fsw9jkS/X1kh0LVsMXAX8OetiXdBOIEBnDJLgjvXYcseyAqO+Ulwk wvxqxwr+qE17FHwbEq2rwi6aOvr6Hl2kGtPwkGu5OweuVR5fRDJmEY+csJ0nzT5qOQv9 amgA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=UBeGMmiwyg0bk2ViaubAzpdFo7Jnmt+cToLDMxTvYHw=; fh=P7Car9/C5vMAyy8kOI26tzeIAuvMsPJG8EcdaPu0pp0=; b=iLKr6Bc4JM/Plsetxvq7jEWPq5GGXndBw1LtI6eg9kaLV3rXhdnhchQCR20Ui/6afo CmPiD+/dBRxbO3SkpJGn9eu/blFMqjwLm1pRmysDifm6d1/v/tvOwuWcingqHbjNaNU2 O8r6RsNYnMYmyxjzG4A7dI7r2jh8hNpgZSYqB2oMBM+xGc8U2fiSv45S3n9zoqdfq6lq 1aw8WFvP5Xow0XdOktL4GnA8E0+LbGJZEI3DuH0nFiZ/OeXeQxAPLdYI9rGyHFqm/mXi Oslgygex7cz40ZEnAgyqNBapuHF02t0IDFndiLfLoZXiWMCyqYaunyrdy6ceC2+X10Mx HdYw==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784680606; x=1785285406; darn=vger.kernel.org; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:from:to:cc:subject :date:message-id:reply-to:content-type; bh=UBeGMmiwyg0bk2ViaubAzpdFo7Jnmt+cToLDMxTvYHw=; b=rsV+j8tuG6nlKKBN7EnLdjJiXIU0qiWyOsE92CQXo/E41bpQDM7w8L3LrgETy7lssB I+qS3IUfogkiaPtgpxsq6ZyAPt3/NcWh8TJ5tWoF390zS6exfpx7D06+DZqSfQYArODm M6KmRQRio+/I9KXonV3XWMTwK8efJzK5u6Z2WGNgKscgz5LIbpZmwtT1cawR10hnT/5D lgvyHAbhTdgdM5YmTpIaaeV36yYaLCd5zWloHhEYabEgKkg6h91NIrQvV6YNbzcTXdXz aPMbTPCE9aS4y0zlYD+mgo0NonNujZ2uolMHm/l8aI8SHX3tgsg220e50go7LEW3UhRM 930w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784680606; x=1785285406; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=UBeGMmiwyg0bk2ViaubAzpdFo7Jnmt+cToLDMxTvYHw=; b=HfEkIMcgrIJ8rBJ9TVEz0ejP1eZ+iWq8UfJjJ/L50mRfs2jVmJ/LgDksdiEEeQ8adu MeK89ShJEO1wC5jOsq2gLW3N5L/Fv9gcXjjNrIQYQQgJQegB+XnyhA7DD74ufKtBQFW9 CL/l/4s9wQd187d8by7WvJiXrBD9+oDNxR43QJwEbILeqcEQgVwbSYK2gu1ADomhmNcp meb5vUqweKHwGStBfltJ2yZU4YO56IUmvOUiVjWFgLqaptF0Cso0ana2yytH1cGKKjf2 AttqfA87LrpQbH1dcZb1wWJKM8PGdRCM9UO+WYwkkYfqZh7bzTyBHOxY7c7O3Grk24Wj Za2w== X-Gm-Message-State: AOJu0YzIJ8HYS8mUYS/GBaT24EOY3C7Y/2CKZQH+Un93k8wzq2uWFQAK ijh0ZJbsEzS+t+D31UTEiEVlUQcou1XTpUwiZnMF/AoBKzgW6eT6WlABXgroAWd61/Lm+rtczzw TUFum2bshRGhqq30BOrDkLC8YccVvZU1aQUH9 X-Gm-Gg: AR+sD12fxiklCiIiKWl2KyDQ2qezdJHYDqpFAG+WpkvDwumILX+aos8D2xxTcSR3Bbx Ily2pYTipJZkMS8Mpuuz4wyYANDHNO0JCP/pzacqdXLEj4DZ/0pTW5TWqBFR+m4ooIkR5JJpNrh GbCNI97tkfiZM1YlB6VBYqLOSZT/5vuh2MCYRYYYoAXTvIXjOkTvkJml12tk6+TH0T4JA0dZYPZ gcBoGPhQt4UKuXkzgC/UKctbCb1mng0kz/LdLxP8eSsbq47RNkrUbU8Lgvd90c= X-Received: by 2002:a53:a50b:0:b0:664:ae6b:b4a0 with SMTP id 956f58d0204a3-6683bdfcaaemr4245504d50.85.1784680606085; Tue, 21 Jul 2026 17:36:46 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260615070530.371640-1-james010kim@gmail.com> In-Reply-To: <20260615070530.371640-1-james010kim@gmail.com> From: James Kim Date: Wed, 22 Jul 2026 09:36:35 +0900 X-Gm-Features: AUfX_myH1cFXdW2ehLc2ulk_MEha2_Q36VAE8_khV2ASBwvD9CJDCZeo11aA8xk Message-ID: Subject: Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free() To: linux-kernel@vger.kernel.org Cc: mporter@kernel.crashing.org, alex.bou9@gmail.com, dan.carpenter@linaro.org, stable@vger.kernel.org, gregkh@linuxfoundation.org, error27@gmail.com, akpm@linux-foundation.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, This is a gentle ping for this patch, as it has not received any feedback for some time. I'm CC'ing Dan Carpenter and Andrew Morton for additional visibility, as this patch fixes a potential use-after-free in the RapidIO driver. Any comments or reviews would be greatly appreciated. Thanks, James Kim On Mon, Jun 15, 2026 at 4:08=E2=80=AFPM James Kim w= rote: > > dma_req_free() drops the mapping reference under buf_mutex and then > dereferences req->map again to unlock the mutex. > > If kref_put() drops the last reference, mport_release_mapping() frees > the mapping, and the subsequent mutex_unlock() dereferences a freed > object. This is a use-after-free. > > Fix this by caching map and md before kref_put() and using the cached > md for mutex unlocking. > > Fixes: 4b0986a36 ("rapidio: add mport character device support") > Cc: stable@vger.kernel.org > Signed-off-by: James Kim > --- > Changes since v1: > - Rebased on v7.1. > - Add Dan Carpenter to Cc for lifetime and use-after-free review. > - No functional changes. > > drivers/rapidio/devices/rio_mport_cdev.c | 11 ++++++++--- > 1 file changed, 8 insertions(+), 3 deletions(-) > > diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/d= evices/rio_mport_cdev.c > index 009b3b595bbf..9b94c9b2fad0 100644 > --- a/drivers/rapidio/devices/rio_mport_cdev.c > +++ b/drivers/rapidio/devices/rio_mport_cdev.c > @@ -564,9 +564,14 @@ static void dma_req_free(struct kref *ref) > } > > if (req->map) { > - mutex_lock(&req->map->md->buf_mutex); > - kref_put(&req->map->ref, mport_release_mapping); > - mutex_unlock(&req->map->md->buf_mutex); > + struct rio_mport_mapping *map =3D req->map; > + struct mport_dev *md =3D map->md; > + > + mutex_lock(&md->buf_mutex); > + kref_put(&map->ref, mport_release_mapping); > + mutex_unlock(&md->buf_mutex); > + > + req->map =3D NULL; > } > > kref_put(&priv->dma_ref, mport_release_dma); > -- > 2.43.0 >