Re: [PATCH V5 07/14] i3c: master: Fix potential UAF in i3c_device_match()

On Fri, Aug 07, 2026 at 05:56:31PM +0300, Adrian Hunter wrote:
> i3c_device_match() dereferences i3cdev->desc without holding the bus
> normal-use lock.  Since the descriptor pointer can be replaced
> concurrently, the dereference can race with descriptor replacement and
> result in a use-after-free.
>
> Protect access to i3cdev->desc with the normal-use lock.  While the lock
> is held, the descriptor is guaranteed to remain valid, so the NULL check
> is also unnecessary and can be removed.
>
> This change depends on "i3c: master: Fix recursive locking during device

Remove "This change",  just depend on ...

> registration".  Prior to that change, taking the normal-use lock in
> i3c_device_match() could recurse on bus->lock during device
> registration.
>
> This fixes "i3c: master: match I3C device through DT and ACPI".

It should be fixes tag, but this patch still not in linus tree yet, not
sure how alex handle this.

Alex:
	Maybe rebase i3c tree,

move "i3c: master: Fix recursive locking during device" before
"i3c: master: match I3C device through DT and ACPI"

Then squash this into "i3c: master: match I3C device through DT and ACPI"

Or simple ignore "this fixes ..." sentense.

Reviewed-by: Frank Li <[email protected]>

Frank

>
> Signed-off-by: Adrian Hunter <[email protected]>
> ---
>
>
> Changes in V4 and V5:
>
> 	None
>
> Changes in V3:
>
> 	New patch
>
>
>  drivers/i3c/master.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index ee771ac0b203..83e04a2c202a 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
> @@ -347,8 +347,10 @@ static int i3c_device_match(struct device *dev, const struct device_driver *drv)
>  	i3cdev = dev_to_i3cdev(dev);
>  	i3cdrv = drv_to_i3cdrv(drv);
>
> -	if (i3cdev->desc && i3cdev->desc->boardinfo)
> +	i3c_bus_normaluse_lock(i3cdev->bus);
> +	if (i3cdev->desc->boardinfo)
>  		static_addr_method = i3cdev->desc->boardinfo->static_addr_method;
> +	i3c_bus_normaluse_unlock(i3cdev->bus);
>
>  	/*
>  	 * SETAASA-based devices need not always have a matching ID since
> --
> 2.53.0
>