rapidio Doorbell Deref

Vulnerability analysis

The Tsi721 RapidIO bridge driver processes incoming doorbell messages by searching a list of registered doorbell handlers. A flag tracking whether a matching handler was found is not reset between iterations, so after the first successful match every subsequent doorbell is incorrectly treated as found. When no matching handler exists, the list iterator ends up pointing to the list head rather than a valid handler object, and the code dereferences it as if it were valid, causing type confusion and potential kernel memory corruption. The fix resets the found flag to false at the start of each loop iteration so only genuine matches are processed. This vulnerability is reachable only from the RapidIO fabric — an attacker must have physical access to the RapidIO interconnect to send doorbell messages, and the target system must have TSI721 bridge hardware present and the driver loaded.