[PATCH RFC] rpmsg: qcom_smd: reject interrupted channel waits

[PATCH RFC] rpmsg: qcom_smd: reject interrupted channel waits

[Slavin Liu]

qcom_smd_create_ept() waits for a channel using
wait_event_interruptible_timeout(). If a signal interrupts the wait
before the named channel appears, the wait returns -ERESTARTSYS and
channel is still NULL. The current zero-only test treats the negative
return as success and then dereferences channel->state.

Require a positive wait result before using the channel. Return NULL for
interruption as for a timeout, following the endpoint creation API's
existing failure convention. No endpoint or channel resources have been
acquired at this point, and the successful wait path is unchanged.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
---
 drivers/rpmsg/qcom_smd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
index 7dbe1c6efe41..7bbd29707f78 100644
--- a/drivers/rpmsg/qcom_smd.c
+++ b/drivers/rpmsg/qcom_smd.c
@@ -914,7 +914,7 @@ static struct rpmsg_endpoint *qcom_smd_create_ept(struct rpmsg_device *rpdev,
 	ret = wait_event_interruptible_timeout(edge->new_channel_event,
 			(channel = qcom_smd_find_channel(edge, name)) != NULL,
 			HZ);
-	if (!ret)
+	if (ret <= 0)
 		return NULL;
 
 	if (channel->state != SMD_CHANNEL_CLOSED) {

Re: [PATCH RFC] rpmsg: qcom_smd: reject interrupted channel waits

[Konrad Dybcio]

On 9/11/26 8:09 AM, Slavin Liu wrote:
> qcom_smd_create_ept() waits for a channel using
> wait_event_interruptible_timeout(). If a signal interrupts the wait
> before the named channel appears, the wait returns -ERESTARTSYS and
> channel is still NULL. The current zero-only test treats the negative
> return as success and then dereferences channel->state.
> 
> Require a positive wait result before using the channel. Return NULL for
> interruption as for a timeout, following the endpoint creation API's
> existing failure convention. No endpoint or channel resources have been
> acquired at this point, and the successful wait path is unchanged.
> 
> Detected by static analysis and reviewed with AI-assisted source auditing.
> 
> Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend")
> Assisted-by: LLM
> Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad