Yuho ChoiandGreg Kroah-Hartman 1306fc4f76 rpmsg: char: Fix use-after-free on probe error path ...

[ Upstream commit 1ff3f528e6 ]

rpmsg_chrdev_probe() stores the newly allocated eptdev in the default
endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If
rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while
the default endpoint may still dispatch callbacks with the stale priv
pointer.

Avoid publishing eptdev through the default endpoint until
rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv
pointer is published should be ignored by rpmsg_ept_cb(). Flow-control
updates can hit rpmsg_ept_flow_cb() in the same window, so make both
callbacks return success when priv is NULL.

Fixes: bc69d10665 ("rpmsg: char: Introduce the "rpmsg-raw" channel")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20260601183247.1962010-1-dbgh9129@gmail.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-07-24 15:54:17 +02:00

..

Kconfig

…

Makefile

…

mtk_rpmsg.c

…

qcom_glink_native.c

…

qcom_glink_native.h

…

qcom_glink_rpm.c

…

qcom_glink_smem.c

…

qcom_glink_ssr.c

…

qcom_smd.c

…

rpmsg_char.c

rpmsg: char: Fix use-after-free on probe error path

2026-07-24 15:54:17 +02:00

rpmsg_char.h

…

rpmsg_core.c

rpmsg: core: fix race in driver_override_show() and use core helper

2026-03-04 07:20:42 -05:00

rpmsg_ctrl.c

…

rpmsg_internal.h

…

rpmsg_ns.c

…

virtio_rpmsg_bus.c

…