TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

leds: rgb: wago-m4: fix rpdev NULL-ptr race in rpmsg_remove

Browse Source 
wago_rpmsg_remove() cleared priv->rpdev without holding send_lock.
wago_send() checks priv->rpdev under send_lock, but a concurrent
remove could null the pointer between the check and the subsequent
rpmsg_trysend(priv->rpdev->ept, ...) dereference, causing a NULL
pointer fault.

Hold send_lock around the priv->rpdev = NULL assignment so that any
in-flight wago_send() either sees a valid pointer for its entire
critical section or sees NULL from the outset.

Reported-by: Oleg Karfich <oleg.karfich@wago.com>
Signed-off-by: Heinrich Toews <ht@twx-software.de>
This commit is contained in:
Heinrich Toews
2026-06-18 17:19:02 +02:00
parent fede4fbf28
commit e7771f5d84
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/leds/rgb/wago-m4-led-wrapper.c
+4 -1
View File
@@ -630,8 +630,11 @@ static void wago_rpmsg_remove(struct rpmsg_device *rpdev)
{
struct wago_m4_led_priv *priv = dev_get_drvdata(&rpdev->dev);
if (priv)
if (priv) {
mutex_lock(&priv->send_lock);
priv->rpdev = NULL;
mutex_unlock(&priv->send_lock);
}
dev_info(&rpdev->dev, "WAGO M4 LED RPMsg channel removed\n");
}