Re: [PATCH v6 02/12] i3c: master: Use unified device property interface

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free and Double-Free on device_register() error path.
--

--- Patch [2]: [PATCH v6 02/12] i3c: master: Use unified device property interface ---
commit 4cd8615c6224b9a8e9ae3761f1ef4f19b3063c29
Author: Akhil R <[email protected]>

i3c: master: Use unified device property interface
    
Replace all OF-specific functions with unified device property functions
as a prerequisite to support both ACPI and device tree.

> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index f1be38a640ca1..4b3d9628bc39b 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c

[ ... ]

> @@ -1928,7 +1930,7 @@ i3c_master_register_new_i3c_devs(struct i3c_master_controller *master)
>  			     desc->info.pid);
>  
>  		if (desc->boardinfo)
> -			desc->dev->dev.of_node = desc->boardinfo->of_node;
> +			device_set_node(&desc->dev->dev, desc->boardinfo->fwnode);
>  
>  		ret = device_register(&desc->dev->dev);
>  		if (ret) {
>  			dev_err(&master->dev,
>  				"Failed to add I3C device (err = %d)\n", ret);
>  			put_device(&desc->dev->dev);

[Severity: High]
This is a pre-existing issue, but does the error path here leave a
dangling pointer in desc->dev?

If device_register() fails, put_device() drops the reference and
i3c_device_release() frees the underlying memory via kfree().
However, desc->dev is not set to NULL.

Later, when the master controller is unregistered, could this lead to a
write-after-free and double-free when the teardown path iterates over
the devices?

drivers/i3c/master.c:i3c_master_unregister_i3c_devs() {
	...
	i3c_bus_for_each_i3cdev(&master->bus, i3cdev) {
		if (!i3cdev->dev)
			continue;

		i3cdev->dev->desc = NULL;
		if (device_is_registered(&i3cdev->dev->dev))
			device_unregister(&i3cdev->dev->dev);
		else
			put_device(&i3cdev->dev->dev);
	...
}

>  		}
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2

-- 
linux-i3c mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-i3c