Ything-RepoMirrors/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-01-24 23:16:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

rust: i2c: do not drop device private data on shutdown()

Browse Source 
We must not drop the device private data on shutdown(); none of the
registrations attached to devres that might access the device private
data are released before shutdown() is called.

Hence, freeing the device private data on shutdown() can cause UAF bugs.

Fixes: 57c5bd9aee ("rust: i2c: add basic I2C device and driver abstractions")
Acked-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Igor Korotin <igor.korotin.linux@gmail.com>
Link: https://patch.msgid.link/20260107103511.570525-2-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
This commit is contained in:
Danilo Krummrich
2026-01-07 11:35:00 +01:00
parent 5d9c4c272b
commit 4181aceb4a
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
rust/kernel/i2c.rs
View File

@@ -181,9 +181,9 @@ impl<T: Driver + 'static> Adapter<T> {
// SAFETY: `shutdown_callback` is only ever called after a successful call to
// `probe_callback`, hence it's guaranteed that `Device::set_drvdata()` has been called
// and stored a `Pin<KBox<T>>`.
let data = unsafe { idev.as_ref().drvdata_obtain::<T>() };
let data = unsafe { idev.as_ref().drvdata_borrow::<T>() };
T::shutdown(idev, data.as_ref());
T::shutdown(idev, data);
}
/// The [`i2c::IdTable`] of the corresponding driver.