From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4BA0B199E94 for ; Mon, 17 Nov 2025 03:42:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763350972; cv=none; b=kTJmr1zQ7cdHkm1ICagxdFVHGEHmOgZxu5vMtvgOMeQ2DGC9PY1m6CE1uP+thJbCPjM+PDp4oiAV+9NU4y3eSu0yIGcp9Drw/jQjN8IhMHHF6rGAFJKJsowGBZXf3CdHL5U9B7TZjRmNgQd3+y7h6wVRlgbRbYNfLHyV2bn0UrM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763350972; c=relaxed/simple; bh=3I7JjgtjEcXutmrwvvR3O4ts1OPoTrC5aBJBBbGSU1s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=IUz/7LT19AZimKNe70FfTZpW1uc9B4N7D5LrgnI2QF6x/zN6gsvw5HVK2ApKW4f0/yzukXoeWDJxu6yGBIp4bGJ8hYxIR2YXKEq0C3IisiwqqaGeSXsQgKJFb7Z1vkoyv+Iw6M6sUVcg2BZ4nHpowq3777MK94BAlKj4X8gTXdQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hxVf4DPp; arc=none smtp.client-ip=209.85.210.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hxVf4DPp" Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-7ad1cd0db3bso3182897b3a.1 for ; Sun, 16 Nov 2025 19:42:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763350970; x=1763955770; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=rJwG+OvVeP+oxmIi79vEgM0XhrkvDaX10R9YOhJIkpA=; b=hxVf4DPpDUpCdwy0pQX8ZaBeWIw4UVaw2PvR74575YUI0Icj3IPL3XdavaddzAVzhW hRxQ814RLzENBC4vf6k4ispCL3kFACn21s9IPYCR7RL6l884WnFPn1KrBqmJQuNcRcSB X8EdoUDXHFJcogrK2MRI3c36SWsXyHXcha5xnLcYi2C/+BBv33CgO1ubZJQNr+QWHpeE 6oop/zo+Xqhdqxbb31A1k9IpJxbHFwjLVZr7S3OARtLF00MbYabt9iwCfmMo49nh6toF B9buMpTQnacrLjlTpJWNPgKwBDi9nlytHrUzK5IwjuealzHVCVXk51jK0kc1Sd0OMG2W Cpkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763350970; x=1763955770; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=rJwG+OvVeP+oxmIi79vEgM0XhrkvDaX10R9YOhJIkpA=; b=Td09O7cz974VNtgJY3K9+Y42mo2l71DvcC9y7OsW7zjG/EXWkbxe0DuLkIKsMKC0zX SG5Yo78LDgEZlefMOtI92rr21i/i5DrYr0L9arNXw+3w4ECTq3f3K4kDvDR4a2aw4L51 cJbzvziHf5yD/Rpezrg/wc+V74EGescyykO6S6+2I/OJqLRV+57NBb+m6zWSKgzG7ZP8 bHuRc48RH2b97nc6WKB6+984Cr3/gmAGJc7G63GSFAyM09bY209cYeIHavfIzDZSsiEL lfv0YC710wp+n1TMcTo14aM/jyFc4jk/2cKQ8PoZSgwffFwFRDDX20OaGmW/vqdPHDFg jQZQ== X-Forwarded-Encrypted: i=1; AJvYcCXyoCXXzZJGC4F3tsWlXeKZsG+TaESVR9HnlYuO6BQyvIs8TCyzBcQvMLgQ46AOfB0K1PrgRMey4DgeMNg=@vger.kernel.org X-Gm-Message-State: AOJu0YzSHZ3lY5DwW/KXvt4ztGCsuu8J2L2eQreU2sFw6EzRVIXlz2tq UPgixMhqONoRGuYDZLzy/14zRXEe5amLVVJsY6Kx8fcdZJjrH42xcj8= X-Gm-Gg: ASbGncuYcXksK1Fua1mA+pQREM4ygdwPQV54i6Amx8/7SPh/Z50XLtscdCr3sCZS8LO NZNSgW24TwfElnJn10g1tern5HeL00mF/cae85awzCBEqsam1NrS0Eul6mad8t8/d7lKkfhHwC6 1ODNKXCL/CMD+mh1bPGVYWMu80okXYksQ8zaA89wNFQ5wHnE3bLQm24vW8uGvB5IMkNqfkunWRx 88049QM4Kt2vKZSUMV9hxRIw8t6h5Z4ar0NAo7KQheIKF0FRKDyO0iSVghJ8so6BTXQuG83K2zO 7/dbT/p/ZxCJmlGdodvlthntgdpRHMw4+agBBkpthxcOUSV3B1J7Rw63Rhg22xHKACp0fB+nkHu 29mhPV0547Xz1muamyiPCuvOUHuPG0YMHIyabAT+QBDcQnFy59+NY65J/aelhhacbBTwnwogYib 8Wk2sxJfBamSKYkDSpVpfhcZI2LijhaHZYon0dvaGq54IJfdm5Fg+YqfSFCQ== X-Google-Smtp-Source: AGHT+IHgX99E9cv28vr8O1yrgmwh6vSZ55vKpp0MJT2JQrEOaj9jsqJ+YmNr+/pK+23KaGgy+6yRXQ== X-Received: by 2002:a05:6a00:13a2:b0:7b8:7f5d:95aa with SMTP id d2e1a72fcca58-7ba3c17e126mr11857011b3a.27.1763350970478; Sun, 16 Nov 2025 19:42:50 -0800 (PST) Received: from samee-VMware-Virtual-Platform.. ([2402:e280:3d9e:537:d8f5:3b3d:a52b:2ac5]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-7b9251d31c8sm11218458b3a.30.2025.11.16.19.42.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 16 Nov 2025 19:42:50 -0800 (PST) From: Sameeksha Sankpal To: wsa+renesas@sang-engineering.com Cc: linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Sameeksha Sankpal , syzbot+76501d32a94a432940a8@syzkaller.appspotmail.com Subject: [PATCH] i2c: core: prevent use-after-free in i2c_get_adapter by removing adapter from IDR earlier Date: Mon, 17 Nov 2025 09:11:50 +0530 Message-ID: <20251117034150.6380-1-sameekshasankpal@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit i2c_del_adapter() currently removes the adapter from i2c_adapter_idr after device_unregister(&adap->dev). This leaves a window where i2c_get_adapter() may still find the adapter and call get_device(), which WARNs because the kobject refcount is already zero. Fix by removing the adapter from the IDR before unregistering the device. This prevents new lookups while the device is being torn down. Reported-by: syzbot+76501d32a94a432940a8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=76501d32a94a432940a8 Signed-off-by: Sameeksha Sankpal --- drivers/i2c/i2c-core-base.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index ae7e9c8b65a6..229158401d54 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1773,6 +1773,15 @@ void i2c_del_adapter(struct i2c_adapter *adap) __process_removed_adapter); mutex_unlock(&core_lock); + /* + * Stop publishing the adapter before tearing down its device/kobject. + * Otherwise i2c_get_adapter() may still find it in the IDR and then + * get_device() will WARN because the kobject is already at 0. + */ + mutex_lock(&core_lock); + idr_remove(&i2c_adapter_idr, adap->nr); + mutex_unlock(&core_lock); + /* Remove devices instantiated from sysfs */ mutex_lock_nested(&adap->userspace_clients_lock, i2c_adapter_depth(adap)); @@ -1813,10 +1822,7 @@ void i2c_del_adapter(struct i2c_adapter *adap) device_unregister(&adap->dev); wait_for_completion(&adap->dev_released); - /* free bus id */ - mutex_lock(&core_lock); - idr_remove(&i2c_adapter_idr, adap->nr); - mutex_unlock(&core_lock); + /* IDR entry already removed above; no new lookups are possible now. */ /* Clear the device structure in case this adapter is ever going to be added again */ -- 2.43.0