diff options
| author | Vasileios Almpanis <vasilisalmpanis@gmail.com> | 2026-08-12 11:14:48 +0200 |
|---|---|---|
| committer | Andi Shyti <andi.shyti@kernel.org> | 2026-08-28 03:12:01 +0200 |
| commit | b15b548d52b43ba8ac4652bc2c7244a8dd1e9622 (patch) | |
| tree | 0b605f892ce4086608fb2b5c3efa74365b7debaa | |
| parent | 27c9445be86b1313746c46d659d3f823a5f7a218 (diff) | |
i2c: core: fix debugfs UAF on adapter removal
i2c_del_adapter() frees the adapter's debugfs directory before it
unregisters the adapter device, but the new_device sysfs attribute
stays writable until device_del(). A write racing with removal still
reaches i2c_device_probe(), which passes the freed adap->debugfs to
debugfs_create_dir() as the new client's parent:
BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430
Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090
lookup_noperm_common+0x407/0x430
simple_start_creating+0x9c/0x110
debugfs_start_creating+0xdb/0x1a0
debugfs_create_dir+0x24/0x350
i2c_device_probe+0x814/0xbf0
It's technically possible to create a client after i2c_deregister_clients
has run. That client will never be unregistered and make
wait_for_completion hang.
Close the window by removing the new_device attribute at the start of
i2c_del_adapter(). device_remove_file() will drain any clients left.
Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter")
Reported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>
Cc: <stable@vger.kernel.org> # v6.8+
Tested-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260812-i2c-v2-1-5efaab4c3334@gmail.com
| -rw-r--r-- | drivers/i2c/i2c-core-base.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index fb25704219c7..ddaacf876dad 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1816,6 +1816,12 @@ void i2c_del_adapter(struct i2c_adapter *adap) return; } + /* + * This drains any in-flight writers, so all + * clients will be caught by i2c_deregister_clients(). + */ + device_remove_file(&adap->dev, &dev_attr_new_device); + i2c_acpi_remove_space_handler(adap); i2c_deregister_clients(adap); |