Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[Andrew Morton]

On Mon, 15 Jun 2026 16:05:30 +0900 James Kim <james010kim@xxxxxxxxx> wrote:

> dma_req_free() drops the mapping reference under buf_mutex and then
> dereferences req->map again to unlock the mutex.
> 
> If kref_put() drops the last reference, mport_release_mapping() frees
> the mapping, and the subsequent mutex_unlock() dereferences a freed
> object. This is a use-after-free.
> 
> Fix this by caching map and md before kref_put() and using the cached
> md for mutex unlocking.
> 
> Fixes: 4b0986a36 ("rapidio: add mport character device support")

12 characters of hash, please.

> Cc: stable@xxxxxxxxxxxxxxx

Is this observable from userspace in any way?

> --- a/drivers/rapidio/devices/rio_mport_cdev.c
> +++ b/drivers/rapidio/devices/rio_mport_cdev.c
> @@ -564,9 +564,14 @@ static void dma_req_free(struct kref *ref)
>  	}
>  
>  	if (req->map) {
> -		mutex_lock(&req->map->md->buf_mutex);
> -		kref_put(&req->map->ref, mport_release_mapping);
> -		mutex_unlock(&req->map->md->buf_mutex);
> +		struct rio_mport_mapping *map = req->map;
> +		struct mport_dev *md = map->md;
> +
> +		mutex_lock(&md->buf_mutex);
> +		kref_put(&map->ref, mport_release_mapping);
> +		mutex_unlock(&md->buf_mutex);
> +
> +		req->map = NULL;
>  	}

lgtm, although rio object lifetimes aren't exactly my strength ;)

It might be safer/saner to do the `req->map = NULL' inside the mutex?


And....

You made Sashiko AI review look at this code.  The results aren't pretty:
	https://sashiko.dev/#/patchset/20260615070530.371640-1-james010kim@xxxxxxxxx

It claims to have found fourteen pre-existing flaws in there :(