[PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[James Kim]

dma_req_free() drops the mapping reference under buf_mutex and then
dereferences req->map again to unlock the mutex.

If kref_put() drops the last reference, mport_release_mapping() frees
the mapping, and the subsequent mutex_unlock() dereferences a freed
object. This is a use-after-free.

Fix this by caching map and md before kref_put() and using the cached
md for mutex unlocking.

Fixes: 4b0986a36 ("rapidio: add mport character device support")
Cc: stable@vger.kernel.org
Signed-off-by: James Kim <james010kim@gmail.com>
---
Changes since v1:
- Rebased on v7.1.
- Add Dan Carpenter to Cc for lifetime and use-after-free review.
- No functional changes.

 drivers/rapidio/devices/rio_mport_cdev.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index 009b3b595bbf..9b94c9b2fad0 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -564,9 +564,14 @@ static void dma_req_free(struct kref *ref)
 	}
 
 	if (req->map) {
-		mutex_lock(&req->map->md->buf_mutex);
-		kref_put(&req->map->ref, mport_release_mapping);
-		mutex_unlock(&req->map->md->buf_mutex);
+		struct rio_mport_mapping *map = req->map;
+		struct mport_dev *md = map->md;
+
+		mutex_lock(&md->buf_mutex);
+		kref_put(&map->ref, mport_release_mapping);
+		mutex_unlock(&md->buf_mutex);
+
+		req->map = NULL;
 	}
 
 	kref_put(&priv->dma_ref, mport_release_dma);
-- 
2.43.0

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[James Kim]

Hi,

This is a gentle ping for this patch, as it has not received any
feedback for some time.

I'm CC'ing Dan Carpenter and Andrew Morton for additional visibility,
as this patch fixes a potential use-after-free in the RapidIO driver.

Any comments or reviews would be greatly appreciated.

Thanks,
James Kim

On Mon, Jun 15, 2026 at 4:08 PM James Kim <james010kim@gmail.com> wrote:
>
> dma_req_free() drops the mapping reference under buf_mutex and then
> dereferences req->map again to unlock the mutex.
>
> If kref_put() drops the last reference, mport_release_mapping() frees
> the mapping, and the subsequent mutex_unlock() dereferences a freed
> object. This is a use-after-free.
>
> Fix this by caching map and md before kref_put() and using the cached
> md for mutex unlocking.
>
> Fixes: 4b0986a36 ("rapidio: add mport character device support")
> Cc: stable@vger.kernel.org
> Signed-off-by: James Kim <james010kim@gmail.com>
> ---
> Changes since v1:
> - Rebased on v7.1.
> - Add Dan Carpenter to Cc for lifetime and use-after-free review.
> - No functional changes.
>
>  drivers/rapidio/devices/rio_mport_cdev.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
> index 009b3b595bbf..9b94c9b2fad0 100644
> --- a/drivers/rapidio/devices/rio_mport_cdev.c
> +++ b/drivers/rapidio/devices/rio_mport_cdev.c
> @@ -564,9 +564,14 @@ static void dma_req_free(struct kref *ref)
>         }
>
>         if (req->map) {
> -               mutex_lock(&req->map->md->buf_mutex);
> -               kref_put(&req->map->ref, mport_release_mapping);
> -               mutex_unlock(&req->map->md->buf_mutex);
> +               struct rio_mport_mapping *map = req->map;
> +               struct mport_dev *md = map->md;
> +
> +               mutex_lock(&md->buf_mutex);
> +               kref_put(&map->ref, mport_release_mapping);
> +               mutex_unlock(&md->buf_mutex);
> +
> +               req->map = NULL;
>         }
>
>         kref_put(&priv->dma_ref, mport_release_dma);
> --
> 2.43.0
>

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[Dan Carpenter]

On Wed, Jul 22, 2026 at 09:36:35AM +0900, James Kim wrote:
> Hi,
> 
> This is a gentle ping for this patch, as it has not received any
> feedback for some time.
> 
> I'm CC'ing Dan Carpenter and Andrew Morton for additional visibility,
> as this patch fixes a potential use-after-free in the RapidIO driver.
> 
> Any comments or reviews would be greatly appreciated.
> 
> Thanks,
> James Kim
> 

Yep.  I think this is a real bug and the fix looks correct.

Reviewed-by: Dan Carpenter <error27@gmail.com>

regards,
dan carpenter

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[Andrew Morton]

On Mon, 15 Jun 2026 16:05:30 +0900 James Kim <james010kim@gmail.com> wrote:

> dma_req_free() drops the mapping reference under buf_mutex and then
> dereferences req->map again to unlock the mutex.
> 
> If kref_put() drops the last reference, mport_release_mapping() frees
> the mapping, and the subsequent mutex_unlock() dereferences a freed
> object. This is a use-after-free.
> 
> Fix this by caching map and md before kref_put() and using the cached
> md for mutex unlocking.
> 
> Fixes: 4b0986a36 ("rapidio: add mport character device support")

12 characters of hash, please.

> Cc: stable@vger.kernel.org

Is this observable from userspace in any way?

> --- a/drivers/rapidio/devices/rio_mport_cdev.c
> +++ b/drivers/rapidio/devices/rio_mport_cdev.c
> @@ -564,9 +564,14 @@ static void dma_req_free(struct kref *ref)
>  	}
>  
>  	if (req->map) {
> -		mutex_lock(&req->map->md->buf_mutex);
> -		kref_put(&req->map->ref, mport_release_mapping);
> -		mutex_unlock(&req->map->md->buf_mutex);
> +		struct rio_mport_mapping *map = req->map;
> +		struct mport_dev *md = map->md;
> +
> +		mutex_lock(&md->buf_mutex);
> +		kref_put(&map->ref, mport_release_mapping);
> +		mutex_unlock(&md->buf_mutex);
> +
> +		req->map = NULL;
>  	}

lgtm, although rio object lifetimes aren't exactly my strength ;)

It might be safer/saner to do the `req->map = NULL' inside the mutex?


And....

You made Sashiko AI review look at this code.  The results aren't pretty:
	https://sashiko.dev/#/patchset/20260615070530.371640-1-james010kim@gmail.com

It claims to have found fourteen pre-existing flaws in there :(

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[Andrew Morton]

On Mon, 15 Jun 2026 16:05:30 +0900 James Kim <james010kim@gmail.com> wrote:

> Fixes: 4b0986a36 ("rapidio: add mport character device support")

I cannot find this commit.  I'll use

	e8de370188d0 ("rapidio: add mport char device driver")

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[James Kim]

Hi Andrew,

Thanks for the review.

Yes, this path is reachable from userspace through the RapidIO mport
character-device interface. When the final mapping reference is dropped
while releasing a DMA request, the subsequent mutex_unlock() may
dereference freed memory, leading to a kernel crash or a KASAN report.

I'll send a v3 which:
 - updates the Fixes tag to the correct commit,
 - clears req->map while holding md->buf_mutex as suggested, and
 - clarifies the userspace reachability in the commit message.

I'll also review the additional Sashiko findings separately rather than
mixing them into this fix.

Thanks,
James

On Thu, Jul 23, 2026 at 9:21 AM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Mon, 15 Jun 2026 16:05:30 +0900 James Kim <james010kim@gmail.com> wrote:
>
> > Fixes: 4b0986a36 ("rapidio: add mport character device support")
>
> I cannot find this commit.  I'll use
>
>         e8de370188d0 ("rapidio: add mport char device driver")