i2c: core: fix debugfs UAF on adapter removal

Vasileios Almpanis posted 1 patch 1 month, 2 weeks ago
There is a newer version of this series
i2c: core: fix debugfs UAF on adapter removal
Posted by Vasileios Almpanis 1 month, 2 weeks ago
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 0131b508c0e2489eac6e121135988f6eeb716f19

diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 3ec04787a737..17cf3d225268 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1815,6 +1815,12 @@ void i2c_del_adapter(struct i2c_adapter *adap)
 		return;
 	}
 
+	/*
+	 * This drains any in-flight writers, so all
+	 * clients will be caught by i2c_deregister_clients().
+	 */
+	device_remove_file(&adap->dev, &dev_attr_new_device);
+
 	i2c_acpi_remove_space_handler(adap);
 
 	i2c_deregister_clients(adap);
Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in lookup_noperm_common
Posted by syzbot 1 month, 2 weeks ago
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
Tested-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com

Tested on:

commit:         0131b508 Merge tag 'ntfs-for-7.2-rc6' of git://git.ker..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16f152c6580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=abdd1c3924a3d690
dashboard link: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13c79079580000

Note: testing is done by a robot and is best-effort only.