Re: [PATCH V5 07/14] i3c: master: Fix potential UAF in i3c_device_match()

From: Alexandre Belloni <alexandre.belloni@bootlin.com>
To: Frank Li <Frank.li@oss.nxp.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>,
	Frank.Li@nxp.com, akhilrajeev@nvidia.com,
	mukesh.savaliya@oss.qualcomm.com, rafael@kernel.org,
	linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org,
	linux-pci@vger.kernel.org, linux-pm@vger.kernel.org
Subject: Re: [PATCH V5 07/14] i3c: master: Fix potential UAF in i3c_device_match()
Date: Sat, 8 Aug 2026 15:07:52 +0200	[thread overview]
Message-ID: <2026080813075281786283@mail.local> (raw)
In-Reply-To: <anY1dU59JIvV-6BB@lizhi-Precision-Tower-5810>

On 07/08/2026 15:43:49-0400, Frank Li wrote:
> On Fri, Aug 07, 2026 at 05:56:31PM +0300, Adrian Hunter wrote:
> > i3c_device_match() dereferences i3cdev->desc without holding the bus
> > normal-use lock.  Since the descriptor pointer can be replaced
> > concurrently, the dereference can race with descriptor replacement and
> > result in a use-after-free.
> >
> > Protect access to i3cdev->desc with the normal-use lock.  While the lock
> > is held, the descriptor is guaranteed to remain valid, so the NULL check
> > is also unnecessary and can be removed.
> >
> > This change depends on "i3c: master: Fix recursive locking during device
> 
> Remove "This change",  just depend on ...
> 
> > registration".  Prior to that change, taking the normal-use lock in
> > i3c_device_match() could recurse on bus->lock during device
> > registration.
> >
> > This fixes "i3c: master: match I3C device through DT and ACPI".
> 
> It should be fixes tag, but this patch still not in linus tree yet, not
> sure how alex handle this.
> 

I've added the Fixes tag, this works as long as the tree isn't rebased
before send the PR to Linus.

> Alex:
> 	Maybe rebase i3c tree,
> 
> move "i3c: master: Fix recursive locking during device" before
> "i3c: master: match I3C device through DT and ACPI"
> 
> Then squash this into "i3c: master: match I3C device through DT and ACPI"
> 
> Or simple ignore "this fixes ..." sentense.
> 
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
> 
> Frank
> 
> >
> > Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
> > ---
> >
> >
> > Changes in V4 and V5:
> >
> > 	None
> >
> > Changes in V3:
> >
> > 	New patch
> >
> >
> >  drivers/i3c/master.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> > index ee771ac0b203..83e04a2c202a 100644
> > --- a/drivers/i3c/master.c
> > +++ b/drivers/i3c/master.c
> > @@ -347,8 +347,10 @@ static int i3c_device_match(struct device *dev, const struct device_driver *drv)
> >  	i3cdev = dev_to_i3cdev(dev);
> >  	i3cdrv = drv_to_i3cdrv(drv);
> >
> > -	if (i3cdev->desc && i3cdev->desc->boardinfo)
> > +	i3c_bus_normaluse_lock(i3cdev->bus);
> > +	if (i3cdev->desc->boardinfo)
> >  		static_addr_method = i3cdev->desc->boardinfo->static_addr_method;
> > +	i3c_bus_normaluse_unlock(i3cdev->bus);
> >
> >  	/*
> >  	 * SETAASA-based devices need not always have a matching ID since
> > --
> > 2.53.0
> >
> 
> -- 
> linux-i3c mailing list
> linux-i3c@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-i3c

-- 
Alexandre Belloni, co-owner and COO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com