From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 898B1224AF7 for ; Thu, 4 Jun 2026 18:05:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780596326; cv=none; b=ark3C2BHXQlxkBv2NzB0lYftNFCroTPRkYDDdb3tyTWx7BMSF/CbbMBfwYzde7qtO8YdHfCnHTAvQ43qn2Mk+bWR8r0MVCNH7YvqF09vvgtPbXjZQrYL/B7XCyj3nOMG3Pl8nEBMPqhYCEO8Sxkwp4/eiiuJ/wYfR6Sygo91Epg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780596326; c=relaxed/simple; bh=eiC2Sv92zgt1vHvdbV+SbNCuzy9QLGT/IwMB3G/ng7I=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ObbZHRObs1Cfp2Kak2PEAtbHUt/ftQzAyyiCfSy2065hYlF5lYQfOJTTIFwGjUMDYfRSe1EcKl17CIWv12SsrUdGYDqbb14qOiHN+lzN2eXN7CF4TqkyULvljbRspeMn4UwRIjnSIVGbW+mGUqgfI0rIDReGw6b4i678tgjo2uQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=qQEpFsit; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="qQEpFsit" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2bf22d29dabso7879355ad.2 for ; Thu, 04 Jun 2026 11:05:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1780596325; x=1781201125; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=iVP3hFBo+HJYV4EfPNLFkfa8vrbFxQZdqZVYHfJ6hyM=; b=qQEpFsitkWhqzf4ZfRNL4LnOTb4kJRT00UZbZH5dZ2/+p0N5LbhNv2J3aSqddO/D5l DmwxHfcd7qz0Aj3wef9B2JLU2ASzTNRtkj6C/C62aRCJPAYIaZiHYsX40OsruKTIKXgb iycKgnLLtwFF8A4+zyR4IAef9jAPfSKHruXGqskDYkwF04MpwV9R2CufeaVgyHIwv7wR ror5DBgh7P5L1jDJBq/GbEz/q+FZRSbSJ5jCWAAUCgFQ7yx2NwV1UDMZl9RYbAr0YjM8 d4VHbbT7tzGhTB2lkBxEVl1MezztznpQpG9I40YXVCupJeSp4T49DuFK1HfobYwa5XDe EEsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780596325; x=1781201125; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=iVP3hFBo+HJYV4EfPNLFkfa8vrbFxQZdqZVYHfJ6hyM=; b=G/9KxYzgcY2GUCEW+E5C+2ZRFVvBGlWHA+dSLUOhLPpxaJ3eiYmuQ3Xh+/C/la82ED L1+3ib1xFcAZ/MD2O5etvQUxGDs6Y9t1YMkjB9GV7dJ5BXAVxjbm23U7P8ClP8l7u2cO kDduT6QrrUYc2+OJyfDuXlo/0aigYNHLrG0TTyj3w3jmWK/USnq9ULtA3/lpazzjMj9B /ao9bIur7vutJV5Vgi8fbtuihsbFtalpv6ryrO9g0RIzgCP5zRzu59z5+af9HuZoUsZ0 1JhjVY1UC0n8yX0QK1ppb3xn84YgKLFcfgzxGeCTBO2p2jkGwBBe8TLTj30Bffjb67kv qQ6w== X-Forwarded-Encrypted: i=1; AFNElJ8tahwH1gwPhFH6Ugbk/dV2kMuy/Sbp9u+wZHwd3FC1o2HV+XpQlzAQJxJsGqWiGo4I0luFYrFNoOn7XtM=@vger.kernel.org X-Gm-Message-State: AOJu0Ywi5GWq3MvQgJAb05R7wj2Hp9JQ4K8rIMCR+PXOGvnOMqOT0ugm mtVprQAjwL4TCpIUHvFZFC5t33nLVeQ9BXnCK/VNENxtpBohqe5esYpfO2M7g32rBxE= X-Gm-Gg: Acq92OE6XJSWX2oRJEEdu9JIvBn44nVTxdbwTusitWWb5fmCjpFbDLRie3kZrRPwoGL 7cRagI49/cdiJ66uZXHbByuZwzauZ/tLAbblInGTy/+MZcTYRvdWNtIagOwYBTs3aes3JHMSn4E GfCqeTc8jxh4Ug0sxD903AreoL4pQcJpcwoALli2lj6SrK8PGVgOaA49IC5s7WH8H11hbN6FdA1 csg1/UYPjzAJUY6B/KpphqnUsUGRLdrOpuTYHxWscaj7YHkAWg4u18AkAwngHlAut4Qzwm+TumL lYWApePw8VtyawjULuqpG5yLkTjRe2Nxxn9Kd0IC4cIksVN5RUbHz46Lq4rHEpXmkCQNVKVi6Ce x5XomjzSzBqHUcP3+9ygc5XtkEZwqGIoOKc34ovdO9V+J9hdxKDvUv4iw9Wa/HgM3gXGX64xcSv zpKhnk+XF4Hqk+ryKcyoSqwc2d0GIEULI+N0OW4Q== X-Received: by 2002:a17:903:3b85:b0:2c1:8fea:4dbf with SMTP id d9443c01a7336-2c18fea4df8mr64105455ad.8.1780596324785; Thu, 04 Jun 2026 11:05:24 -0700 (PDT) Received: from p14s ([2604:3d09:148c:c800:7a42:c699:9c48:5a81]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c16649fcdfsm85352065ad.78.2026.06.04.11.05.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Jun 2026 11:05:24 -0700 (PDT) Date: Thu, 4 Jun 2026 12:05:21 -0600 From: Mathieu Poirier To: Yuho Choi Cc: Bjorn Andersson , linux-remoteproc@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] rpmsg: char: fix use-after-free on probe error path Message-ID: References: <20260601183247.1962010-1-dbgh9129@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260601183247.1962010-1-dbgh9129@gmail.com> On Mon, Jun 01, 2026 at 02:32:47PM -0400, Yuho Choi wrote: > rpmsg_chrdev_probe() stores the newly allocated eptdev in the default > endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If > rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while > the default endpoint may still dispatch callbacks with the stale priv > pointer. > > Avoid publishing eptdev through the default endpoint until > rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv > pointer is published should be ignored by rpmsg_ept_cb(). Flow-control > updates can hit rpmsg_ept_flow_cb() in the same window, so make both > callbacks return success when priv is NULL. > > Fixes: bc69d1066569 ("rpmsg: char: Introduce the "rpmsg-raw" channel") > Signed-off-by: Yuho Choi > --- > Changes in v2: > - Use a 12-character Fixes SHA. > - Drop the unnecessary asm-generic/rwonce.h include. > - Handle NULL priv in rpmsg_ept_flow_cb() as well. > drivers/rpmsg/rpmsg_char.c | 15 +++++++++++++-- > 1 file changed, 13 insertions(+), 2 deletions(-) > Applied. Thanks, Mathieu > diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c > index ca9cf8858a5e..bff5aefee212 100644 > --- a/drivers/rpmsg/rpmsg_char.c > +++ b/drivers/rpmsg/rpmsg_char.c > @@ -104,6 +104,9 @@ static int rpmsg_ept_cb(struct rpmsg_device *rpdev, void *buf, int len, > struct rpmsg_eptdev *eptdev = priv; > struct sk_buff *skb; > > + if (!eptdev) > + return 0; > + > skb = alloc_skb(len, GFP_ATOMIC); > if (!skb) > return -ENOMEM; > @@ -124,6 +127,9 @@ static int rpmsg_ept_flow_cb(struct rpmsg_device *rpdev, void *priv, bool enable > { > struct rpmsg_eptdev *eptdev = priv; > > + if (!eptdev) > + return 0; > + > eptdev->remote_flow_restricted = enable; > eptdev->remote_flow_updated = true; > > @@ -490,6 +496,7 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev) > struct rpmsg_channel_info chinfo; > struct rpmsg_eptdev *eptdev; > struct device *dev = &rpdev->dev; > + int ret; > > memcpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE); > chinfo.src = rpdev->src; > @@ -502,13 +509,17 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev) > /* Set the default_ept to the rpmsg device endpoint */ > eptdev->default_ept = rpdev->ept; > > + ret = rpmsg_chrdev_eptdev_add(eptdev, chinfo); > + > + if (ret) > + return ret; > /* > * The rpmsg_ept_cb uses *priv parameter to get its rpmsg_eptdev context. > - * Storedit in default_ept *priv field. > + * Stored it in default_ept *priv field. > */ > eptdev->default_ept->priv = eptdev; > > - return rpmsg_chrdev_eptdev_add(eptdev, chinfo); > + return 0; > } > > static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev) > -- > 2.43.0 >