On 9/11/26 8:09 AM, Slavin Liu wrote:
> qcom_smd_create_ept() waits for a channel using
> wait_event_interruptible_timeout(). If a signal interrupts the wait
> before the named channel appears, the wait returns -ERESTARTSYS and
> channel is still NULL. The current zero-only test treats the negative
> return as success and then dereferences channel->state.
>
> Require a positive wait result before using the channel. Return NULL for
> interruption as for a timeout, following the endpoint creation API's
> existing failure convention. No endpoint or channel resources have been
> acquired at this point, and the successful wait path is unchanged.
>
> Detected by static analysis and reviewed with AI-assisted source auditing.
>
> Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend")
> Assisted-by: LLM
> Signed-off-by: Slavin Liu <[email protected]>
> ---
Reviewed-by: Konrad Dybcio <[email protected]>
Konrad
