Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[Dan Carpenter <error27@gmail.com>]

On Thu, Jul 23, 2026 at 09:48:41AM +0900, James Kim wrote:
> Hi Andrew,
> 
> Thanks for the review.
> 
> Yes, this path is reachable from userspace through the RapidIO mport
> character-device interface. When the final mapping reference is dropped
> while releasing a DMA request, the subsequent mutex_unlock() may
> dereference freed memory, leading to a kernel crash or a KASAN report.
> 
> I'll send a v3 which:
>  - updates the Fixes tag to the correct commit,
>  - clears req->map while holding md->buf_mutex as suggested, and
>  - clarifies the userspace reachability in the commit message.
> 
> I'll also review the additional Sashiko findings separately rather than
> mixing them into this fix.
> 

These kinds of use after free bugs are hard to detect at runtime unless
you have poisoning enabled.  It's freed and then used immediately so
it would be hard for a race condition to change the memory between the
free and the use.

regards,
dan carpenter