From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f197.google.com (mail-oi1-f197.google.com [209.85.167.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8EB3537647B for ; Sat, 1 Aug 2026 10:15:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.197 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785579318; cv=none; b=K4GZTW76YE/CFix6D503V0VnG4tDqUSGl6vJJseghERi9vm4/d0JX2sRfsuWry6ShpWkyTHZLxwDkSbimm2BgoVSCkhrImuyJ3ouM5YgEHGhKJith2ea749mdoVcmF1sBZKSSE7hfbC/ocN+OWZPQ/ZSjXQ3N8FMTUAKoWZ0PFk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785579318; c=relaxed/simple; bh=mW6+rtCJ2JzQyavhJaAG3WoZRnIGruib2oOhA7hRuho=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=siidLF1bjHz+UQh6hQ8aptMWfU+FLcQAQdJSqcMiezwjzz20lFdy+MgmQid2uWs77p3XgUc0KR1ruxPjanYi7XBVb0m65k0dN3owl/zHFTzEGHNui94YM7mOAjSx9LkMzDiRqOkXo4hAmdh6WB+G6JjyEvQ2m1IrBhz1+pjOzkw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f197.google.com with SMTP id 5614622812f47-4ab4dd46ddeso1158615b6e.3 for ; Sat, 01 Aug 2026 03:15:16 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785579315; x=1786184115; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=C7ega63obzZ6k4HoNLpnLKCtGfi6o4JRsj0aetDdHUQ=; b=OiXBpeM76UwzpIp2H8Ip9nkYuaEnOuFWswc2VO7Q4KZOaUFTXjtHMm/0swfgjh6QLv UDTmOPNG8Qd+WqVlgaMkAl2xDVVHwLDU2+ea+GeOFLMPCQlX+H6YWBVCDrP/FGgzxGRv pgHXv/+JUCEB3uRTk/mO7ZjxqvQ6g7a4vJ4mMnUv67vul/tDK4ym1tMZd30aYaAjf4mj 0efeu+Te8XAeeVJQ7Vs6/Uu0qfdrN7EfGzKscPf1HxaqR9/dQtSeXgbWilfgzRIjx6IZ 5TOE5TBHU5hFVjGrqcK4m8Hl59m6vFz2dMc/k5Ymj8lsnYBsIORSd6o1HUx0TPfwOflJ NsPA== X-Gm-Message-State: AOJu0YxuzdcAzXjt2gnGRSDgQcJwqXiN81OBqhwQXAvsz4xbxHZXh0v2 qLwkksNJm5hy2Jk3CHR+ofxfBgAxZb1B+W1pz8U8XeTTuqZvQW5kSPUZxjxAkWQyjViB7CThPE7 wzPJsQf6vD2dv4qqKnTa9h1pmIwNxtOY1XIiSGYr5ZiQymgwNRbtGyYTBvas= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6808:3090:b0:49b:33c8:4b75 with SMTP id 5614622812f47-4af5e033dcamr6308530b6e.5.1785579315356; Sat, 01 Aug 2026 03:15:15 -0700 (PDT) Date: Sat, 01 Aug 2026 03:15:15 -0700 In-Reply-To: <6a6aac38.79190830.3d7c75.0018.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a6dc733.f794c993.27aeb.000f.GAE@google.com> Subject: Forwarded: [PATCH] i2c: core: fix debugfs UAF on adapter removal From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] i2c: core: fix debugfs UAF on adapter removal Author: vasilisalmpanis@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master i2c_del_adapter() frees the adapter's debugfs directory before it unregisters the adapter device, but the new_device sysfs attribute stays writable until device_del(). A write racing with removal still reaches i2c_device_probe(), which passes the freed adap->debugfs to debugfs_create_dir() as the new client's parent: BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430 Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090 lookup_noperm_common+0x407/0x430 simple_start_creating+0x9c/0x110 debugfs_start_creating+0xdb/0x1a0 debugfs_create_dir+0x24/0x350 i2c_device_probe+0x814/0xbf0 Such a racing write can also instantiate a client after the client sweep in i2c_deregister_clients() has run. That client is never unregistered and its reference on the adapter device would make the final wait_for_completion() hang. Close the window by removing the new_device attribute at the start of i2c_del_adapter(): device_remove_file() drains in-flight writers, so every client created through this interface is caught by the client sweep. The attribute group removal in device_del() silently skips the already-removed file, so no double removal occurs. With no way left to create clients during teardown, remove the debugfs directory only once the adapter device has been released. Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter") Reported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7 Signed-off-by: Vasileios Almpanis --- drivers/i2c/i2c-core-base.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 3ec04787a737..b7f5dbca9fac 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1815,6 +1815,13 @@ void i2c_del_adapter(struct i2c_adapter *adap) return; } + /* + * Prevent new clients from being instantiated via sysfs while the + * adapter is torn down. This drains any in-flight writers, so all + * clients will be caught by i2c_deregister_clients() below. + */ + device_remove_file(&adap->dev, &dev_attr_new_device); + i2c_acpi_remove_space_handler(adap); i2c_deregister_clients(adap); @@ -1826,8 +1833,6 @@ void i2c_del_adapter(struct i2c_adapter *adap) i2c_host_notify_irq_teardown(adap); - debugfs_remove_recursive(adap->debugfs); - /* wait until all references to the device are gone * * FIXME: This is old code and should ideally be replaced by an @@ -1839,6 +1844,9 @@ void i2c_del_adapter(struct i2c_adapter *adap) device_unregister(&adap->dev); wait_for_completion(&adap->dev_released); + /* clients use this directory as their debugfs parent */ + debugfs_remove_recursive(adap->debugfs); + /* free bus id */ mutex_lock(&core_lock); idr_remove(&i2c_adapter_idr, adap->nr); -- 2.47.3