github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

i3c: master: Fix potential UAF in i3c_device_match()

Browse Source 
i3c_device_match() dereferences i3cdev->desc without holding the bus
normal-use lock.  Since the descriptor pointer can be replaced
concurrently, the dereference can race with descriptor replacement and
result in a use-after-free.

Protect access to i3cdev->desc with the normal-use lock.  While the lock
is held, the descriptor is guaranteed to remain valid, so the NULL check
is also unnecessary and can be removed.

This change depends on "i3c: master: Fix recursive locking during device
registration".  Prior to that change, taking the normal-use lock in
i3c_device_match() could recurse on bus->lock during device
registration.

Fixes: 3456baa211 ("i3c: master: match I3C device through DT and ACPI")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-8-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
This commit is contained in:
Adrian Hunter 2026-08-07 17:56:31 +03:00 committed by Alexandre Belloni
parent e5e8dd2e95
commit f44d3b1532
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/i3c/master.c
View File

@ -347,8 +347,10 @@ static int i3c_device_match(struct device *dev, const struct device_driver *drv)
i3cdev = dev_to_i3cdev(dev);
i3cdrv = drv_to_i3cdrv(drv);
if (i3cdev->desc && i3cdev->desc->boardinfo)
i3c_bus_normaluse_lock(i3cdev->bus);
if (i3cdev->desc->boardinfo)
static_addr_method = i3cdev->desc->boardinfo->static_addr_method;
i3c_bus_normaluse_unlock(i3cdev->bus);
/*
* SETAASA-based devices need not always have a matching ID since