From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8FAB63BE141; Tue, 21 Jul 2026 21:07:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784668032; cv=none; b=p9c7HIIymVFxq7v0zPQAqLCH5z+IQic29Gyc2VciOLIzef66vlc243/rRt4jvzjwm1nKG1Qxncfb6eqi14SYc/SMnk8KkWrBgkW97Ac8OW0ylmewTG8HucEkVwLczI3eD2Hj+Dw40xHQ8ndCwhZ8jtlR3T9LD8ztR6xdWgMEU9k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784668032; c=relaxed/simple; bh=tFUgusTMXYp9pkGcuLqvHarQEdaMhHyI7qh3R6N4Q0w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=clNDnPFvQNDV+2yC3D2N9Vt2KCOkg3OMXhmnNnpVqzxd5oRIJR8grO3cB/M94adw7j5A8aKqQNuFrLm+HViWCU/S3nCTm481rKCfPqe34f2N8vyTg109fzBlUMTUTO8b1M8vxv2kK9fuECGlHPD9mHUVgc/8kDyE8qlEgHjnk38= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bWcWCZTX; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="bWcWCZTX" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F423D1F00A3A; Tue, 21 Jul 2026 21:07:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784668031; bh=npbQN6xtBxI6Wo5U3+XeSmdxNaxAEmjt0VkdNPpB6o4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bWcWCZTXtbn0OYECw89qjX3ZfhUo68nj2+SKupDmuq9lY/MLKDsN8uoy8zEzVlxCB j7QPYY/qt80aVkpOAjChzeYg4PN84151SncQMaN3ByfDgbaxHoelS/0Y4YUty9F89J mRBfZycqPkhJevdKOmptcCP0MkHwifffyy2JlFdA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yuho Choi , Mathieu Poirier , Sasha Levin Subject: [PATCH 6.1 0023/1067] rpmsg: char: Fix use-after-free on probe error path Date: Tue, 21 Jul 2026 17:10:24 +0200 Message-ID: <20260721152425.055171699@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152424.521567757@linuxfoundation.org> References: <20260721152424.521567757@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yuho Choi [ Upstream commit 1ff3f528e67d20e2b1483dcaba899dc7832b2e6b ] rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer. Avoid publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv pointer is published should be ignored by rpmsg_ept_cb(). Flow-control updates can hit rpmsg_ept_flow_cb() in the same window, so make both callbacks return success when priv is NULL. Fixes: bc69d1066569 ("rpmsg: char: Introduce the "rpmsg-raw" channel") Signed-off-by: Yuho Choi Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260601183247.1962010-1-dbgh9129@gmail.com Signed-off-by: Mathieu Poirier Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/rpmsg/rpmsg_char.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) --- a/drivers/rpmsg/rpmsg_char.c +++ b/drivers/rpmsg/rpmsg_char.c @@ -100,6 +100,9 @@ static int rpmsg_ept_cb(struct rpmsg_dev struct rpmsg_eptdev *eptdev = priv; struct sk_buff *skb; + if (!eptdev) + return 0; + skb = alloc_skb(len, GFP_ATOMIC); if (!skb) return -ENOMEM; @@ -448,6 +451,7 @@ static int rpmsg_chrdev_probe(struct rpm struct rpmsg_channel_info chinfo; struct rpmsg_eptdev *eptdev; struct device *dev = &rpdev->dev; + int ret; memcpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE); chinfo.src = rpdev->src; @@ -460,13 +464,17 @@ static int rpmsg_chrdev_probe(struct rpm /* Set the default_ept to the rpmsg device endpoint */ eptdev->default_ept = rpdev->ept; + ret = rpmsg_chrdev_eptdev_add(eptdev, chinfo); + + if (ret) + return ret; /* * The rpmsg_ept_cb uses *priv parameter to get its rpmsg_eptdev context. - * Storedit in default_ept *priv field. + * Stored it in default_ept *priv field. */ eptdev->default_ept->priv = eptdev; - return rpmsg_chrdev_eptdev_add(eptdev, chinfo); + return 0; } static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev)