Re: [PATCH] i3c: master: Fix info leak and UAF in device unregister path
Alexandre Belloni <[email protected]> Thu, 30 Jul 2026 16:42:37 +0200
| Newsgroups | org.infradead.lists.linux-i3c,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <178542243595.1793527.17198193788870118191.b4-ty@b4> |
On Thu, 23 Jul 2026 10:57:47 +0300, Adrian Hunter wrote:
> i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before
> calling device_unregister(). During device_unregister(),
> device_del() emits a KOBJ_REMOVE uevent and unbinds the driver while
> the device descriptor is still expected to be valid. As a result,
> i3c_device_uevent() and a racing modalias_show() can observe a NULL
> desc and fall back to an uninitialized stack struct i3c_device_info,
> leaking kernel stack contents in the generated modalias. Driver
> .remove() callbacks may also encounter an unexpected NULL desc during
> unbind.
>
> [...]
Applied, thanks!
[1/1] i3c: master: Fix info leak and UAF in device unregister path
https://git.kernel.org/i3c/c/6f056a769b9f
Best regards,
--
Alexandre Belloni, co-owner and COO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
--
linux-i3c mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-i3c