* [PATCH] remoteproc: Fix potential null pointer dereference in pru_rproc_set_ctable()
@ 2025-09-23 8:38 Zhen Ni
2025-09-23 9:40 ` Zhongqiu Han
2025-09-23 11:21 ` [PATCH v2] remoteproc: pru: Fix potential NULL " Zhen Ni
0 siblings, 2 replies; 6+ messages in thread
From: Zhen Ni @ 2025-09-23 8:38 UTC (permalink / raw)
To: andersson, mathieu.poirier; +Cc: linux-remoteproc, Zhen Ni, stable
pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL
check, which could lead to a null pointer dereference. Move the pru
assignment, ensuring we never dereference a NULL rproc pointer.
Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function")
Cc: stable@vger.kernel.org
Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
---
drivers/remoteproc/pru_rproc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c
index 842e4b6cc5f9..5e3eb7b86a0e 100644
--- a/drivers/remoteproc/pru_rproc.c
+++ b/drivers/remoteproc/pru_rproc.c
@@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put);
*/
int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
{
- struct pru_rproc *pru = rproc->priv;
+ struct pru_rproc *pru;
unsigned int reg;
u32 mask, set;
u16 idx;
@@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent))
return -ENODEV;
+ pru = rproc->priv;
/* pointer is 16 bit and index is 8-bit so mask out the rest */
idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] remoteproc: Fix potential null pointer dereference in pru_rproc_set_ctable()
2025-09-23 8:38 [PATCH] remoteproc: Fix potential null pointer dereference in pru_rproc_set_ctable() Zhen Ni
@ 2025-09-23 9:40 ` Zhongqiu Han
2025-09-23 9:52 ` Zhongqiu Han
2025-09-23 11:21 ` [PATCH v2] remoteproc: pru: Fix potential NULL " Zhen Ni
1 sibling, 1 reply; 6+ messages in thread
From: Zhongqiu Han @ 2025-09-23 9:40 UTC (permalink / raw)
To: Zhen Ni, andersson, mathieu.poirier
Cc: linux-remoteproc, stable, zhongqiu.han
On 9/23/2025 4:38 PM, Zhen Ni wrote:
> pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL
> check, which could lead to a null pointer dereference. Move the pru
> assignment, ensuring we never dereference a NULL rproc pointer.
>
> Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
LGTM. Minor style suggestion: consider changing "null" to "NULL" in the
subject/commit message for consistency with kernel coding style and
terminology.
FWIW. Please feel free to comment or override if needed.
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
> ---
> drivers/remoteproc/pru_rproc.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c
> index 842e4b6cc5f9..5e3eb7b86a0e 100644
> --- a/drivers/remoteproc/pru_rproc.c
> +++ b/drivers/remoteproc/pru_rproc.c
> @@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put);
> */
> int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
> {
> - struct pru_rproc *pru = rproc->priv;
> + struct pru_rproc *pru;
> unsigned int reg;
> u32 mask, set;
> u16 idx;
> @@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
> if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent))
> return -ENODEV;
>
> + pru = rproc->priv;
> /* pointer is 16 bit and index is 8-bit so mask out the rest */
> idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;
>
--
Thx and BRs,
Zhongqiu Han
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] remoteproc: Fix potential null pointer dereference in pru_rproc_set_ctable()
2025-09-23 9:40 ` Zhongqiu Han
@ 2025-09-23 9:52 ` Zhongqiu Han
0 siblings, 0 replies; 6+ messages in thread
From: Zhongqiu Han @ 2025-09-23 9:52 UTC (permalink / raw)
To: Zhen Ni, andersson, mathieu.poirier; +Cc: linux-remoteproc, stable
On 9/23/2025 5:40 PM, Zhongqiu Han wrote:
> On 9/23/2025 4:38 PM, Zhen Ni wrote:
>> pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL
>> check, which could lead to a null pointer dereference. Move the pru
>> assignment, ensuring we never dereference a NULL rproc pointer.
>>
>> Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable()
>> function")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
>
>
> LGTM. Minor style suggestion: consider changing "null" to "NULL" in the
> subject/commit message for consistency with kernel coding style and
> terminology.
>
Also, for consistency with subsystem tagging conventions, please
consider updating the subject line to:
remoteproc: pru: Fix potential NULL pointer dereference in
pru_rproc_set_ctable()
This makes it clearer that the change is specific to the PRU driver
under remoteproc.
>
> FWIW. Please feel free to comment or override if needed.
>
> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
>
>
>> ---
>> drivers/remoteproc/pru_rproc.c | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/
>> pru_rproc.c
>> index 842e4b6cc5f9..5e3eb7b86a0e 100644
>> --- a/drivers/remoteproc/pru_rproc.c
>> +++ b/drivers/remoteproc/pru_rproc.c
>> @@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put);
>> */
>> int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c,
>> u32 addr)
>> {
>> - struct pru_rproc *pru = rproc->priv;
>> + struct pru_rproc *pru;
>> unsigned int reg;
>> u32 mask, set;
>> u16 idx;
>> @@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum
>> pru_ctable_idx c, u32 addr)
>> if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent))
>> return -ENODEV;
>> + pru = rproc->priv;
>> /* pointer is 16 bit and index is 8-bit so mask out the rest */
>> idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;
>
--
Thx and BRs,
Zhongqiu Han
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
2025-09-23 8:38 [PATCH] remoteproc: Fix potential null pointer dereference in pru_rproc_set_ctable() Zhen Ni
2025-09-23 9:40 ` Zhongqiu Han
@ 2025-09-23 11:21 ` Zhen Ni
2025-09-23 13:36 ` Zhongqiu Han
2025-09-23 18:01 ` Mathieu Poirier
1 sibling, 2 replies; 6+ messages in thread
From: Zhen Ni @ 2025-09-23 11:21 UTC (permalink / raw)
To: andersson, mathieu.poirier; +Cc: linux-remoteproc, Zhen Ni, stable
pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL
check, which could lead to a null pointer dereference. Move the pru
assignment, ensuring we never dereference a NULL rproc pointer.
Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function")
Cc: stable@vger.kernel.org
Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
---
v2:
- Changed "null" to "NULL"
- Added " pru:" prefix
---
drivers/remoteproc/pru_rproc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c
index 842e4b6cc5f9..5e3eb7b86a0e 100644
--- a/drivers/remoteproc/pru_rproc.c
+++ b/drivers/remoteproc/pru_rproc.c
@@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put);
*/
int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
{
- struct pru_rproc *pru = rproc->priv;
+ struct pru_rproc *pru;
unsigned int reg;
u32 mask, set;
u16 idx;
@@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent))
return -ENODEV;
+ pru = rproc->priv;
/* pointer is 16 bit and index is 8-bit so mask out the rest */
idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
2025-09-23 11:21 ` [PATCH v2] remoteproc: pru: Fix potential NULL " Zhen Ni
@ 2025-09-23 13:36 ` Zhongqiu Han
2025-09-23 18:01 ` Mathieu Poirier
1 sibling, 0 replies; 6+ messages in thread
From: Zhongqiu Han @ 2025-09-23 13:36 UTC (permalink / raw)
To: Zhen Ni, andersson, mathieu.poirier
Cc: linux-remoteproc, stable, zhongqiu.han
On 9/23/2025 7:21 PM, Zhen Ni wrote:
> pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL
> check, which could lead to a null pointer dereference. Move the pru
> assignment, ensuring we never dereference a NULL rproc pointer.
>
> Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
> ---
> v2:
> - Changed "null" to "NULL"
> - Added " pru:" prefix
- Link to v1:
https://lore.kernel.org/all/20250923083848.1147347-1-zhen.ni@easystack.cn/
> ---
> drivers/remoteproc/pru_rproc.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c
> index 842e4b6cc5f9..5e3eb7b86a0e 100644
> --- a/drivers/remoteproc/pru_rproc.c
> +++ b/drivers/remoteproc/pru_rproc.c
> @@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put);
> */
> int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
> {
> - struct pru_rproc *pru = rproc->priv;
> + struct pru_rproc *pru;
> unsigned int reg;
> u32 mask, set;
> u16 idx;
> @@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
> if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent))
> return -ENODEV;
>
> + pru = rproc->priv;
> /* pointer is 16 bit and index is 8-bit so mask out the rest */
> idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;
>
--
Thx and BRs,
Zhongqiu Han
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
2025-09-23 11:21 ` [PATCH v2] remoteproc: pru: Fix potential NULL " Zhen Ni
2025-09-23 13:36 ` Zhongqiu Han
@ 2025-09-23 18:01 ` Mathieu Poirier
1 sibling, 0 replies; 6+ messages in thread
From: Mathieu Poirier @ 2025-09-23 18:01 UTC (permalink / raw)
To: Zhen Ni; +Cc: andersson, linux-remoteproc, stable
On Tue, Sep 23, 2025 at 07:21:09PM +0800, Zhen Ni wrote:
> pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL
> check, which could lead to a null pointer dereference. Move the pru
> assignment, ensuring we never dereference a NULL rproc pointer.
>
> Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
Applied.
Thanks,
Mathieu
> ---
> v2:
> - Changed "null" to "NULL"
> - Added " pru:" prefix
> ---
> drivers/remoteproc/pru_rproc.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c
> index 842e4b6cc5f9..5e3eb7b86a0e 100644
> --- a/drivers/remoteproc/pru_rproc.c
> +++ b/drivers/remoteproc/pru_rproc.c
> @@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put);
> */
> int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
> {
> - struct pru_rproc *pru = rproc->priv;
> + struct pru_rproc *pru;
> unsigned int reg;
> u32 mask, set;
> u16 idx;
> @@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
> if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent))
> return -ENODEV;
>
> + pru = rproc->priv;
> /* pointer is 16 bit and index is 8-bit so mask out the rest */
> idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;
>
> --
> 2.20.1
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-09-23 18:01 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-09-23 8:38 [PATCH] remoteproc: Fix potential null pointer dereference in pru_rproc_set_ctable() Zhen Ni
2025-09-23 9:40 ` Zhongqiu Han
2025-09-23 9:52 ` Zhongqiu Han
2025-09-23 11:21 ` [PATCH v2] remoteproc: pru: Fix potential NULL " Zhen Ni
2025-09-23 13:36 ` Zhongqiu Han
2025-09-23 18:01 ` Mathieu Poirier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).