This is an automated email from the ASF dual-hosted git repository. anchao pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit b79dc18e015b2fa625dc2cf45c9b3f59864ee2ff Author: Bowen Wang <[email protected]> AuthorDate: Thu Oct 29 01:22:47 2026 +0800 drivers/rpmsg: take rdev from priv in the port ns callback rpmsg_port_ns_callback() reads the device from ept->rdev. But rpmsg_register_endpoint() adds the NS endpoint to the endpoint list without holding rdev->lock, while the RX thread looks endpoints up under that lock, so the RX thread can find the NS endpoint before ept->rdev is visible to it and rpmsg_port_ns_callback() then dereferences NULL in metal_mutex_acquire(). The NS endpoint's priv already holds the port, set by rpmsg_port_register(), so take rdev from priv instead. Signed-off-by: Bowen Wang <[email protected]> --- drivers/rpmsg/rpmsg_port.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/rpmsg/rpmsg_port.c b/drivers/rpmsg/rpmsg_port.c index 7ef8692aea7..7fa3cd0e1ea 100644 --- a/drivers/rpmsg/rpmsg_port.c +++ b/drivers/rpmsg/rpmsg_port.c @@ -478,7 +478,8 @@ static int rpmsg_port_ns_callback(FAR struct rpmsg_endpoint *ept, FAR void *data, size_t len, uint32_t src, FAR void *priv) { - FAR struct rpmsg_device *rdev = ept->rdev; + FAR struct rpmsg_port_s *port = priv; + FAR struct rpmsg_device *rdev = &port->rdev; FAR struct rpmsg_ns_msg *msg = data; FAR const char *name = msg->name; uint32_t dest = msg->addr;
