staging: nvec: fix use-after-free in nvec_rx_completed()

In nvec_rx_completed(), when an incomplete RX transfer is detected,
nvec_msg_free() is called to return the message back to the pool by
clearing its 'used' atomic flag. Immediately after this, the code
accesses nvec->rx->data[0] to check the message type.

Since nvec_msg_free() marks the pool slot as available via atomic_set(),
any concurrent or subsequent call to nvec_msg_alloc() could claim that
same slot and overwrite its data[] array. Reading nvec->rx->data[0] after
freeing the message is therefore a use-after-free.

Fix this by saving the message type byte before calling nvec_msg_free(),
then using the saved value for the battery quirk check.

Fixes: d6bdcf2e1019 ("staging: nvec: Add battery quirk to ignore incomplete responses")
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260427081713.3401874-2-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index 952c5a849a563d8c3aadf2c4412601d2e67e8574..2a3499dd4d63422eb50b20373b7297076d972f6a 100644 (file)
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -494,6 +494,8 @@ static void nvec_tx_completed(struct nvec_chip *nvec)
 static void nvec_rx_completed(struct nvec_chip *nvec)
 {
        if (nvec->rx->pos != nvec_msg_size(nvec->rx)) {
+               unsigned char msg_type = nvec->rx->data[0];
+
                dev_err(nvec->dev, "RX incomplete: Expected %u bytes, got %u\n",
                        (uint)nvec_msg_size(nvec->rx),
                        (uint)nvec->rx->pos);
@@ -502,7 +504,7 @@ static void nvec_rx_completed(struct nvec_chip *nvec)
                nvec->state = 0;
 
                /* Battery quirk - Often incomplete, and likes to crash */
-               if (nvec->rx->data[0] == NVEC_BAT)
+               if (msg_type == NVEC_BAT)
                        complete(&nvec->ec_transfer);
 
                return;