[PATCH V3 07/14] i3c: master: Fix potential UAF in i3c_device_match()
Adrian Hunter <[email protected]>
| Newsgroups | org.kernel.vger.linux-pm,org.infradead.lists.linux-i3c,org.kernel.vger.linux-kernel,org.kernel.vger.linux-pci |
|---|---|
| Organization | Intel Finland Oy, Registered Address: c/o Alberga Business Park, 6 krs, Bertel Jungin Aukio 5, 02600 Espoo, Business Identity Code: 0357606 - 4, Domiciled in Helsinki |
| Message-ID | <[email protected]> |
i3c_device_match() dereferences i3cdev->desc without holding the bus normal-use lock. Since the descriptor pointer can be replaced concurrently, the dereference can race with descriptor replacement and result in a use-after-free. Protect access to i3cdev->desc with the normal-use lock. While the lock is held, the descriptor is guaranteed to remain valid, so the NULL check is also unnecessary and can be removed. This change depends on "i3c: master: Fix recursive locking during device registration". Prior to that change, taking the normal-use lock in i3c_device_match() could recurse on bus->lock during device registration. This fixes "i3c: master: match I3C device through DT and ACPI". Signed-off-by: Adrian Hunter <[email protected]> --- Changes in V3: New patch drivers/i3c/master.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index 947ab3c681d5..e7ea41007889 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -347,8 +347,10 @@ static int i3c_device_match(struct device *dev, const struct device_driver *drv) i3cdev = dev_to_i3cdev(dev); i3cdrv = drv_to_i3cdrv(drv); - if (i3cdev->desc && i3cdev->desc->boardinfo) + i3c_bus_normaluse_lock(i3cdev->bus); + if (i3cdev->desc->boardinfo) static_addr_method = i3cdev->desc->boardinfo->static_addr_method; + i3c_bus_normaluse_unlock(i3cdev->bus); /* * SETAASA-based devices need not always have a matching ID since -- 2.53.0