Re: [PATCH] remoteproc: Fix potential null pointer dereference in pru_rproc_set_ctable()

[Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>]

On 9/23/2025 5:40 PM, Zhongqiu Han wrote:
> On 9/23/2025 4:38 PM, Zhen Ni wrote:
>> pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL
>> check, which could lead to a null pointer dereference. Move the pru
>> assignment, ensuring we never dereference a NULL rproc pointer.
>>
>> Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() 
>> function")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
> 
> 
> LGTM. Minor style suggestion: consider changing "null" to "NULL" in the
> subject/commit message for consistency with kernel coding style and
> terminology.
> 

Also, for consistency with subsystem tagging conventions, please
consider updating the subject line to:

remoteproc: pru: Fix potential NULL pointer dereference in
pru_rproc_set_ctable()

This makes it clearer that the change is specific to the PRU driver
under remoteproc.


> 
> FWIW. Please feel free to comment or override if needed.
> 
> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
> 
> 
>> ---
>>   drivers/remoteproc/pru_rproc.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/ 
>> pru_rproc.c
>> index 842e4b6cc5f9..5e3eb7b86a0e 100644
>> --- a/drivers/remoteproc/pru_rproc.c
>> +++ b/drivers/remoteproc/pru_rproc.c
>> @@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put);
>>    */
>>   int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, 
>> u32 addr)
>>   {
>> -    struct pru_rproc *pru = rproc->priv;
>> +    struct pru_rproc *pru;
>>       unsigned int reg;
>>       u32 mask, set;
>>       u16 idx;
>> @@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum 
>> pru_ctable_idx c, u32 addr)
>>       if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent))
>>           return -ENODEV;
>> +    pru = rproc->priv;
>>       /* pointer is 16 bit and index is 8-bit so mask out the rest */
>>       idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;
> 


-- 
Thx and BRs,
Zhongqiu Han