From e7771f5d84dd8b678e1ab0d76af106d4f73cf8e1 Mon Sep 17 00:00:00 2001 From: Heinrich Toews Date: Thu, 18 Jun 2026 17:19:02 +0200 Subject: [PATCH] leds: rgb: wago-m4: fix rpdev NULL-ptr race in rpmsg_remove wago_rpmsg_remove() cleared priv->rpdev without holding send_lock. wago_send() checks priv->rpdev under send_lock, but a concurrent remove could null the pointer between the check and the subsequent rpmsg_trysend(priv->rpdev->ept, ...) dereference, causing a NULL pointer fault. Hold send_lock around the priv->rpdev = NULL assignment so that any in-flight wago_send() either sees a valid pointer for its entire critical section or sees NULL from the outset. Reported-by: Oleg Karfich Signed-off-by: Heinrich Toews --- drivers/leds/rgb/wago-m4-led-wrapper.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/leds/rgb/wago-m4-led-wrapper.c b/drivers/leds/rgb/wago-m4-led-wrapper.c index 8f2ff5bab023..776bad37317b 100644 --- a/drivers/leds/rgb/wago-m4-led-wrapper.c +++ b/drivers/leds/rgb/wago-m4-led-wrapper.c @@ -630,8 +630,11 @@ static void wago_rpmsg_remove(struct rpmsg_device *rpdev) { struct wago_m4_led_priv *priv = dev_get_drvdata(&rpdev->dev); - if (priv) + if (priv) { + mutex_lock(&priv->send_lock); priv->rpdev = NULL; + mutex_unlock(&priv->send_lock); + } dev_info(&rpdev->dev, "WAGO M4 LED RPMsg channel removed\n"); }