Re: [PATCH v2] rapidio: mport_cdev: fix use-after-free in dma_req_free()

[James Kim]

Hi Andrew,

Thanks for the review.

Yes, this path is reachable from userspace through the RapidIO mport
character-device interface. When the final mapping reference is dropped
while releasing a DMA request, the subsequent mutex_unlock() may
dereference freed memory, leading to a kernel crash or a KASAN report.

I'll send a v3 which:
 - updates the Fixes tag to the correct commit,
 - clears req->map while holding md->buf_mutex as suggested, and
 - clarifies the userspace reachability in the commit message.

I'll also review the additional Sashiko findings separately rather than
mixing them into this fix.

Thanks,
James

On Thu, Jul 23, 2026 at 9:21 AM Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
>
> On Mon, 15 Jun 2026 16:05:30 +0900 James Kim <james010kim@xxxxxxxxx> wrote:
>
> > Fixes: 4b0986a36 ("rapidio: add mport character device support")
>
> I cannot find this commit.  I'll use
>
>         e8de370188d0 ("rapidio: add mport char device driver")