From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f200.google.com (mail-oi1-f200.google.com [209.85.167.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AAB4E2F745C for ; Sat, 1 Aug 2026 08:03:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.200 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785571400; cv=none; b=NZgNLEJKsfsBEjSMMlNbkC0Zxcb1S0KlYl0igcPSHAH1GGZdykN5Pxii1m9TRukXLYkrvS7FXjEWsyeeDJBBoufxooibz2xaRgnewu3FvVqG+Qn5r/UkRTM7Vx+0+sc7109U9DKA2X+gyA+God5aB4R1i5nkcJ5ZHT55ADEooas= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785571400; c=relaxed/simple; bh=1yti21AQ4KwLm/RFgd7M6pI4r1dkRNcl3ZzLZRXYA98=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=q7Cci26Q1HgdjclZOTfErPFM89NlKCt2/1izvacCp84axIKANbGP0A0GZXwL4swCJanUFTxbZJc1bBLQ8d2lErXsF1drv8UplsPscf7OYqXVZhhKMd04MtIUBPkKEz3WUGgUHDWeCniJtg16wC7sHQSKFKGWDULlr/o7k4QPx5E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f200.google.com with SMTP id 5614622812f47-485ebc5706cso3703133b6e.0 for ; Sat, 01 Aug 2026 01:03:18 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785571397; x=1786176197; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=WDIehKz3tjFEECkbG+g2S9T1MZ26i+g9Tg9iw0ZAsnM=; b=McCtwLEVfGvXU8fVfKMQWa6jY/vpNnOg7Yf1oclApBv4tiVJl4lQJBtPbyGzUTNCmU p06z8O+qL9t7OLSxKQYPZiRwmTNcXPCmtkzotSTCfrOKe7Wq3rJ9xHSB/F7Oh+NZsWZE y6jihFMYNztFxyoX2WqPiSlJZzprHUNTW2pSIVh1AbM6vAxxybbikMYjhsC9o6dwkGL7 LmYh5uwKk2CMjSqZCljYwwn6I25uwYu93Hll1fWpDDzo7mAoyvhyfqr/j3Ur7DnHb3oG qD1G8/61I0v8ku7E1I1s/sO6MpkdcHzkHzxBz3ODYo6nlOdBhDk+XGtLjXAJezPdnoul sdUQ== X-Gm-Message-State: AOJu0YyNsHudmXpdxs7adldGvcnxaaV+bblGxFNdU+UPkql9ea1QImBx SSdZedAZqDyGRvPBc/PwW39Q3bfSVZEMlq5kMLUUZSdqnePaLVkcsva35FELwm3TSjbtCHMDydE t6CmOdt9R+KHEIpXPEo0iuZaCaZky/B+3xiBUW2LiiDwWWCiOE+uXx+v+K6g= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6808:b2a:b0:4a4:cedc:6859 with SMTP id 5614622812f47-4ae3188b062mr6183075b6e.4.1785571397613; Sat, 01 Aug 2026 01:03:17 -0700 (PDT) Date: Sat, 01 Aug 2026 01:03:17 -0700 In-Reply-To: <6a6aac38.79190830.3d7c75.0018.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a6da845.2d659fcc.1d46f5.01b8.GAE@google.com> Subject: Forwarded: [PATCH] i2c: core: fix debugfs UAF on adapter removal From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] i2c: core: fix debugfs UAF on adapter removal Author: vasilisalmpanis@gmail.com #syz test i2c_del_adapter() frees the adapter's debugfs directory before it unregisters the adapter device, but the new_device sysfs attribute stays writable until device_del(). A write racing with removal still reaches i2c_device_probe(), which passes the freed adap->debugfs to debugfs_create_dir() as the new client's parent: BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430 Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090 lookup_noperm_common+0x407/0x430 simple_start_creating+0x9c/0x110 debugfs_start_creating+0xdb/0x1a0 debugfs_create_dir+0x24/0x350 i2c_device_probe+0x814/0xbf0 Such a racing write can also instantiate a client after the client sweep in i2c_deregister_clients() has run. That client is never unregistered and its reference on the adapter device would make the final wait_for_completion() hang. Close the window by removing the new_device attribute at the start of i2c_del_adapter(): device_remove_file() drains in-flight writers, so every client created through this interface is caught by the client sweep. The attribute group removal in device_del() silently skips the already-removed file, so no double removal occurs. With no way left to create clients during teardown, remove the debugfs directory only once the adapter device has been released. Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter") Reported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7 Signed-off-by: Vasileios Almpanis --- drivers/i2c/i2c-core-base.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 3ec04787a737..b7f5dbca9fac 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1815,6 +1815,13 @@ void i2c_del_adapter(struct i2c_adapter *adap) return; } + /* + * Prevent new clients from being instantiated via sysfs while the + * adapter is torn down. This drains any in-flight writers, so all + * clients will be caught by i2c_deregister_clients() below. + */ + device_remove_file(&adap->dev, &dev_attr_new_device); + i2c_acpi_remove_space_handler(adap); i2c_deregister_clients(adap); @@ -1826,8 +1833,6 @@ void i2c_del_adapter(struct i2c_adapter *adap) i2c_host_notify_irq_teardown(adap); - debugfs_remove_recursive(adap->debugfs); - /* wait until all references to the device are gone * * FIXME: This is old code and should ideally be replaced by an @@ -1839,6 +1844,9 @@ void i2c_del_adapter(struct i2c_adapter *adap) device_unregister(&adap->dev); wait_for_completion(&adap->dev_released); + /* clients use this directory as their debugfs parent */ + debugfs_remove_recursive(adap->debugfs); + /* free bus id */ mutex_lock(&core_lock); idr_remove(&i2c_adapter_idr, adap->nr); -- 2.47.3