[PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[James Kim]

dma_req_free() drops the mapping reference under buf_mutex and then
dereferences req->map again to unlock the mutex.

If kref_put() drops the last reference, mport_release_mapping() frees
the mapping, and the subsequent mutex_unlock() dereferences a freed
object. This is a use-after-free.

Fix this by caching map and md before kref_put() and using the cached
md for mutex unlocking.

Fixes: 4b0986a36 ("rapidio: add mport character device support")
Cc: stable@vger.kernel.org
Signed-off-by: James Kim <james010kim@gmail.com>
---
Changes since v1:
- Rebased on v7.1.
- Add Dan Carpenter to Cc for lifetime and use-after-free review.
- No functional changes.

 drivers/rapidio/devices/rio_mport_cdev.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index 009b3b595bbf..9b94c9b2fad0 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -564,9 +564,14 @@ static void dma_req_free(struct kref *ref)
 	}
 
 	if (req->map) {
-		mutex_lock(&req->map->md->buf_mutex);
-		kref_put(&req->map->ref, mport_release_mapping);
-		mutex_unlock(&req->map->md->buf_mutex);
+		struct rio_mport_mapping *map = req->map;
+		struct mport_dev *md = map->md;
+
+		mutex_lock(&md->buf_mutex);
+		kref_put(&map->ref, mport_release_mapping);
+		mutex_unlock(&md->buf_mutex);
+
+		req->map = NULL;
 	}
 
 	kref_put(&priv->dma_ref, mport_release_dma);
-- 
2.43.0

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[James Kim]

Hi,

This is a gentle ping for this patch, as it has not received any
feedback for some time.

I'm CC'ing Dan Carpenter and Andrew Morton for additional visibility,
as this patch fixes a potential use-after-free in the RapidIO driver.

Any comments or reviews would be greatly appreciated.

Thanks,
James Kim

On Mon, Jun 15, 2026 at 4:08 PM James Kim <james010kim@gmail.com> wrote:
>
> dma_req_free() drops the mapping reference under buf_mutex and then
> dereferences req->map again to unlock the mutex.
>
> If kref_put() drops the last reference, mport_release_mapping() frees
> the mapping, and the subsequent mutex_unlock() dereferences a freed
> object. This is a use-after-free.
>
> Fix this by caching map and md before kref_put() and using the cached
> md for mutex unlocking.
>
> Fixes: 4b0986a36 ("rapidio: add mport character device support")
> Cc: stable@vger.kernel.org
> Signed-off-by: James Kim <james010kim@gmail.com>
> ---
> Changes since v1:
> - Rebased on v7.1.
> - Add Dan Carpenter to Cc for lifetime and use-after-free review.
> - No functional changes.
>
>  drivers/rapidio/devices/rio_mport_cdev.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
> index 009b3b595bbf..9b94c9b2fad0 100644
> --- a/drivers/rapidio/devices/rio_mport_cdev.c
> +++ b/drivers/rapidio/devices/rio_mport_cdev.c
> @@ -564,9 +564,14 @@ static void dma_req_free(struct kref *ref)
>         }
>
>         if (req->map) {
> -               mutex_lock(&req->map->md->buf_mutex);
> -               kref_put(&req->map->ref, mport_release_mapping);
> -               mutex_unlock(&req->map->md->buf_mutex);
> +               struct rio_mport_mapping *map = req->map;
> +               struct mport_dev *md = map->md;
> +
> +               mutex_lock(&md->buf_mutex);
> +               kref_put(&map->ref, mport_release_mapping);
> +               mutex_unlock(&md->buf_mutex);
> +
> +               req->map = NULL;
>         }
>
>         kref_put(&priv->dma_ref, mport_release_dma);
> --
> 2.43.0
>

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[Dan Carpenter]

On Wed, Jul 22, 2026 at 09:36:35AM +0900, James Kim wrote:
> Hi,
> 
> This is a gentle ping for this patch, as it has not received any
> feedback for some time.
> 
> I'm CC'ing Dan Carpenter and Andrew Morton for additional visibility,
> as this patch fixes a potential use-after-free in the RapidIO driver.
> 
> Any comments or reviews would be greatly appreciated.
> 
> Thanks,
> James Kim
> 

Yep.  I think this is a real bug and the fix looks correct.

Reviewed-by: Dan Carpenter <error27@gmail.com>

regards,
dan carpenter

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[Andrew Morton]

On Mon, 15 Jun 2026 16:05:30 +0900 James Kim <james010kim@gmail.com> wrote:

> dma_req_free() drops the mapping reference under buf_mutex and then
> dereferences req->map again to unlock the mutex.
> 
> If kref_put() drops the last reference, mport_release_mapping() frees
> the mapping, and the subsequent mutex_unlock() dereferences a freed
> object. This is a use-after-free.
> 
> Fix this by caching map and md before kref_put() and using the cached
> md for mutex unlocking.
> 
> Fixes: 4b0986a36 ("rapidio: add mport character device support")

12 characters of hash, please.

> Cc: stable@vger.kernel.org

Is this observable from userspace in any way?

> --- a/drivers/rapidio/devices/rio_mport_cdev.c
> +++ b/drivers/rapidio/devices/rio_mport_cdev.c
> @@ -564,9 +564,14 @@ static void dma_req_free(struct kref *ref)
>  	}
>  
>  	if (req->map) {
> -		mutex_lock(&req->map->md->buf_mutex);
> -		kref_put(&req->map->ref, mport_release_mapping);
> -		mutex_unlock(&req->map->md->buf_mutex);
> +		struct rio_mport_mapping *map = req->map;
> +		struct mport_dev *md = map->md;
> +
> +		mutex_lock(&md->buf_mutex);
> +		kref_put(&map->ref, mport_release_mapping);
> +		mutex_unlock(&md->buf_mutex);
> +
> +		req->map = NULL;
>  	}

lgtm, although rio object lifetimes aren't exactly my strength ;)

It might be safer/saner to do the `req->map = NULL' inside the mutex?


And....

You made Sashiko AI review look at this code.  The results aren't pretty:
	https://sashiko.dev/#/patchset/20260615070530.371640-1-james010kim@gmail.com

It claims to have found fourteen pre-existing flaws in there :(

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[Andrew Morton]

On Mon, 15 Jun 2026 16:05:30 +0900 James Kim <james010kim@gmail.com> wrote:

> Fixes: 4b0986a36 ("rapidio: add mport character device support")

I cannot find this commit.  I'll use

	e8de370188d0 ("rapidio: add mport char device driver")

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[James Kim]

Hi Andrew,

Thanks for the review.

Yes, this path is reachable from userspace through the RapidIO mport
character-device interface. When the final mapping reference is dropped
while releasing a DMA request, the subsequent mutex_unlock() may
dereference freed memory, leading to a kernel crash or a KASAN report.

I'll send a v3 which:
 - updates the Fixes tag to the correct commit,
 - clears req->map while holding md->buf_mutex as suggested, and
 - clarifies the userspace reachability in the commit message.

I'll also review the additional Sashiko findings separately rather than
mixing them into this fix.

Thanks,
James

On Thu, Jul 23, 2026 at 9:21 AM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Mon, 15 Jun 2026 16:05:30 +0900 James Kim <james010kim@gmail.com> wrote:
>
> > Fixes: 4b0986a36 ("rapidio: add mport character device support")
>
> I cannot find this commit.  I'll use
>
>         e8de370188d0 ("rapidio: add mport char device driver")

Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[Dan Carpenter]

On Thu, Jul 23, 2026 at 09:48:41AM +0900, James Kim wrote:
> Hi Andrew,
> 
> Thanks for the review.
> 
> Yes, this path is reachable from userspace through the RapidIO mport
> character-device interface. When the final mapping reference is dropped
> while releasing a DMA request, the subsequent mutex_unlock() may
> dereference freed memory, leading to a kernel crash or a KASAN report.
> 
> I'll send a v3 which:
>  - updates the Fixes tag to the correct commit,
>  - clears req->map while holding md->buf_mutex as suggested, and
>  - clarifies the userspace reachability in the commit message.
> 
> I'll also review the additional Sashiko findings separately rather than
> mixing them into this fix.
> 

These kinds of use after free bugs are hard to detect at runtime unless
you have poisoning enabled.  It's freed and then used immediately so
it would be hard for a race condition to change the memory between the
free and the use.

regards,
dan carpenter

[PATCH v3] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[James Kim]

dma_req_free() acquires buf_mutex through req->map, drops the mapping
reference with kref_put(), and then dereferences req->map again to
unlock the mutex.

If kref_put() drops the last reference, mport_release_mapping() frees
the mapping, and the subsequent mutex_unlock() dereferences a freed
object. This is a use-after-free.

Fix this by caching map and md before kref_put(), clearing req->map
while holding buf_mutex, and using the cached md for mutex unlocking.

The bug is reachable from userspace via the RapidIO mport character
device interface.

Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Cc: stable@vger.kernel.org
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: James Kim <james010kim@gmail.com>

---
Changes since v2:
- Correct the Fixes tag.
- Clear req->map while holding buf_mutex.
- Clarify that the bug is reachable from userspace.
- Update Dan Carpenter's email address and add his Reviewed-by tag.

Changes since v1:
- Rebase on v7.1.
- Add Dan Carpenter to Cc for lifetime and use-after-free review.
- No functional changes.
---
 drivers/rapidio/devices/rio_mport_cdev.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index 009b3b595bbf..ad82c2108a56 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -564,9 +564,13 @@ static void dma_req_free(struct kref *ref)
 	}
 
 	if (req->map) {
-		mutex_lock(&req->map->md->buf_mutex);
-		kref_put(&req->map->ref, mport_release_mapping);
-		mutex_unlock(&req->map->md->buf_mutex);
+		struct rio_mport_mapping *map = req->map;
+		struct mport_dev *md = map->md;
+
+		mutex_lock(&md->buf_mutex);
+		req->map = NULL;
+		kref_put(&map->ref, mport_release_mapping);
+		mutex_unlock(&md->buf_mutex);
 	}
 
 	kref_put(&priv->dma_ref, mport_release_dma);
-- 
2.25.1

Re: [PATCH v3] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[James Kim]

Hi Andrew,

Thanks for picking up this patch.

I noticed that the version currently queued in mm-everything appears to
correspond to v2 (commit c044e529fa01).

The v3 update includes one additional change based on your review by
clearing req->map while holding md->buf_mutex:

        mutex_lock(&md->buf_mutex);
        req->map = NULL;
        kref_put(&map->ref, mport_release_mapping);
        mutex_unlock(&md->buf_mutex);

The v3 posting is available here:

https://lore.kernel.org/lkml/20260723235220.588424-1-james010kim@gmail.com/

If it's still convenient, could you please replace the queued version
with v3?

Thanks!

James

On Fri, Jul 24, 2026 at 8:53 AM James Kim <james010kim@gmail.com> wrote:
>
> dma_req_free() acquires buf_mutex through req->map, drops the mapping
> reference with kref_put(), and then dereferences req->map again to
> unlock the mutex.
>
> If kref_put() drops the last reference, mport_release_mapping() frees
> the mapping, and the subsequent mutex_unlock() dereferences a freed
> object. This is a use-after-free.
>
> Fix this by caching map and md before kref_put(), clearing req->map
> while holding buf_mutex, and using the cached md for mutex unlocking.
>
> The bug is reachable from userspace via the RapidIO mport character
> device interface.
>
> Fixes: e8de370188d0 ("rapidio: add mport char device driver")
> Cc: stable@vger.kernel.org
> Reviewed-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: James Kim <james010kim@gmail.com>
>
> ---
> Changes since v2:
> - Correct the Fixes tag.
> - Clear req->map while holding buf_mutex.
> - Clarify that the bug is reachable from userspace.
> - Update Dan Carpenter's email address and add his Reviewed-by tag.
>
> Changes since v1:
> - Rebase on v7.1.
> - Add Dan Carpenter to Cc for lifetime and use-after-free review.
> - No functional changes.
> ---
>  drivers/rapidio/devices/rio_mport_cdev.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
> index 009b3b595bbf..ad82c2108a56 100644
> --- a/drivers/rapidio/devices/rio_mport_cdev.c
> +++ b/drivers/rapidio/devices/rio_mport_cdev.c
> @@ -564,9 +564,13 @@ static void dma_req_free(struct kref *ref)
>         }
>
>         if (req->map) {
> -               mutex_lock(&req->map->md->buf_mutex);
> -               kref_put(&req->map->ref, mport_release_mapping);
> -               mutex_unlock(&req->map->md->buf_mutex);
> +               struct rio_mport_mapping *map = req->map;
> +               struct mport_dev *md = map->md;
> +
> +               mutex_lock(&md->buf_mutex);
> +               req->map = NULL;
> +               kref_put(&map->ref, mport_release_mapping);
> +               mutex_unlock(&md->buf_mutex);
>         }
>
>         kref_put(&priv->dma_ref, mport_release_dma);
> --
> 2.25.1
>