qcom_smd_create_ept() waits for a channel using
wait_event_interruptible_timeout(). If a signal interrupts the wait
before the named channel appears, the wait returns -ERESTARTSYS and
channel is still NULL. The current zero-only test treats the negative
return as success and then dereferences channel->state.
Require a positive wait result before using the channel. Return NULL for
interruption as for a timeout, following the endpoint creation API's
existing failure convention. No endpoint or channel resources have been
acquired at this point, and the successful wait path is unchanged.
Detected by static analysis and reviewed with AI-assisted source auditing.
Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend")
Assisted-by: LLM
Signed-off-by: Slavin Liu <[email protected]>
---
drivers/rpmsg/qcom_smd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
index 7dbe1c6efe41..7bbd29707f78 100644
--- a/drivers/rpmsg/qcom_smd.c
+++ b/drivers/rpmsg/qcom_smd.c
@@ -914,7 +914,7 @@ static struct rpmsg_endpoint *qcom_smd_create_ept(struct
rpmsg_device *rpdev,
ret = wait_event_interruptible_timeout(edge->new_channel_event,
(channel = qcom_smd_find_channel(edge, name)) != NULL,
HZ);
- if (!ret)
+ if (ret <= 0)
return NULL;
if (channel->state != SMD_CHANNEL_CLOSED) {
