[PATCH -next] firmware: imx: Add missing return in error path to prevent use-after-free.

[PATCH -next] firmware: imx: Add missing return in error path to prevent use-after-free.

[Pankaj Gupta]

After freeing dev_ctx and setting *new_dev_ctx to NULL, the function
continues execution and dereferences dev_ctx, leading to a potential
use-after-free. Return immediately to avoid accessing freed memory.

This appears to have been lost during merge of the original fix.

Fixes: 3ae9dcce8400 ("firmware: drivers: imx: adds miscdev")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com>
---
 drivers/firmware/imx/se_ctrl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/firmware/imx/se_ctrl.c b/drivers/firmware/imx/se_ctrl.c
index 9327d47e4312..4914d3b6bf0b 100644
--- a/drivers/firmware/imx/se_ctrl.c
+++ b/drivers/firmware/imx/se_ctrl.c
@@ -486,6 +486,8 @@ static int init_device_context(struct se_if_priv *priv, int ch_id,
 		kfree(dev_ctx->devname);
 		kfree(dev_ctx);
 		*new_dev_ctx = NULL;
+
+		return ret;
 	}
 
 	list_add_tail(&dev_ctx->link, &priv->dev_ctx_list);
-- 
2.43.0

Re: [PATCH -next] firmware: imx: Add missing return in error path to prevent use-after-free.

[Dan Carpenter]

On Thu, May 28, 2026 at 02:44:46PM +0530, Pankaj Gupta wrote:
> After freeing dev_ctx and setting *new_dev_ctx to NULL, the function
> continues execution and dereferences dev_ctx, leading to a potential
> use-after-free. Return immediately to avoid accessing freed memory.
> 
> This appears to have been lost during merge of the original fix.
> 
> Fixes: 3ae9dcce8400 ("firmware: drivers: imx: adds miscdev")
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com>

I try not to be a whiner about patch attibution to me because I feel
like I get enough credit for stuff and don't need to complain about
small things.  But it's puzzling to see my Signed-off-by here and
normally someone would ask about it.

I did write a patch for this but you have modified the commit message
and added a blank line.
https://lore.kernel.org/all/agv_jhP-2CNTfQXk@stanley.mountain/
Potentially, you already had written this patch by the time I sent
mine because it was a static checker fix and a lot of people run static
checkers.

Normally these tags are in chronoligical order and a Signed-off-by would
mean I handled the patch.  It doesn't make sense for me to be the first
person to handle the patch if I didn't write it.

I suspect what happened is that actually I should get authorship credit
but when you modified the patch, the authorship was lost.  (I have
done this mistake unintentionally before.  More than once).  To give
authorship credit, the first line in the body of the email would be:

From: Dan Carpenter <error27@gmail.com>

But if you already had a patch written then just give me a
Reported-by tag instead.  Either way is fine.

Sorry again, for being a bit nit picky on this...

regards,
dan carpenter

Re: [PATCH -next] firmware: imx: Add missing return in error path to prevent use-after-free.

[Frank.Li]

From: Frank Li <Frank.Li@nxp.com>


On Thu, 28 May 2026 14:44:46 +0530, Pankaj Gupta wrote:
> After freeing dev_ctx and setting *new_dev_ctx to NULL, the function
> continues execution and dereferences dev_ctx, leading to a potential
> use-after-free. Return immediately to avoid accessing freed memory.
> 
> This appears to have been lost during merge of the original fix.
> 
> 
> [...]

Applied, thanks!

[1/1] firmware: imx: Add missing return in error path to prevent use-after-free.
      commit: 28599a13adb5db6b4fb63ce088766c456f8f562b

Best regards,
-- 
Frank Li <Frank.Li@nxp.com>