On 9/23/2025 5:40 PM, Zhongqiu Han wrote:

On 9/23/2025 4:38 PM, Zhen Ni wrote:

...

pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL check, which could lead to a null pointer dereference. Move the pru assignment, ensuring we never dereference a NULL rproc pointer.

Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni zhen.ni@easystack.cn

LGTM. Minor style suggestion: consider changing "null" to "NULL" in the subject/commit message for consistency with kernel coding style and terminology.

Also, for consistency with subsystem tagging conventions, please consider updating the subject line to:

remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()

This makes it clearer that the change is specific to the PRU driver under remoteproc.

FWIW. Please feel free to comment or override if needed.

Reviewed-by: Zhongqiu Han zhongqiu.han@oss.qualcomm.com

...

---

drivers/remoteproc/pru_rproc.c | 3 ++-   1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/ pru_rproc.c index 842e4b6cc5f9..5e3eb7b86a0e 100644 --- a/drivers/remoteproc/pru_rproc.c +++ b/drivers/remoteproc/pru_rproc.c @@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put);    */   int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)   { -    struct pru_rproc *pru = rproc->priv; +    struct pru_rproc *pru;       unsigned int reg;       u32 mask, set;       u16 idx; @@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)       if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent))           return -ENODEV; +    pru = rproc->priv;       /* pointer is 16 bit and index is 8-bit so mask out the rest */       idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;

On 9/23/2025 7:21 PM, Zhen Ni wrote:

pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL check, which could lead to a null pointer dereference. Move the pru assignment, ensuring we never dereference a NULL rproc pointer.

Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni zhen.ni@easystack.cn

---

v2:

• Changed "null" to "NULL"
• Added " pru:" prefix

- Link to v1: https://lore.kernel.org/all/20250923083848.1147347-1-zhen.ni@easystack.cn/

---

drivers/remoteproc/pru_rproc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c index 842e4b6cc5f9..5e3eb7b86a0e 100644 --- a/drivers/remoteproc/pru_rproc.c +++ b/drivers/remoteproc/pru_rproc.c @@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put); */ int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr) {

• struct pru_rproc *pru = rproc->priv;

• struct pru_rproc *pru; unsigned int reg; u32 mask, set; u16 idx;

@@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr) if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent)) return -ENODEV;

• pru = rproc->priv; /* pointer is 16 bit and index is 8-bit so mask out the rest */ idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;