Skip to content

Commit 4181ace

Browse files
author
Danilo Krummrich
committed
rust: i2c: do not drop device private data on shutdown()
We must not drop the device private data on shutdown(); none of the registrations attached to devres that might access the device private data are released before shutdown() is called. Hence, freeing the device private data on shutdown() can cause UAF bugs. Fixes: 57c5bd9 ("rust: i2c: add basic I2C device and driver abstractions") Acked-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Igor Korotin <igor.korotin.linux@gmail.com> Link: https://patch.msgid.link/20260107103511.570525-2-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
1 parent 5d9c4c2 commit 4181ace

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

rust/kernel/i2c.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -181,9 +181,9 @@ impl<T: Driver + 'static> Adapter<T> {
181181
// SAFETY: `shutdown_callback` is only ever called after a successful call to
182182
// `probe_callback`, hence it's guaranteed that `Device::set_drvdata()` has been called
183183
// and stored a `Pin<KBox<T>>`.
184-
let data = unsafe { idev.as_ref().drvdata_obtain::<T>() };
184+
let data = unsafe { idev.as_ref().drvdata_borrow::<T>() };
185185

186-
T::shutdown(idev, data.as_ref());
186+
T::shutdown(idev, data);
187187
}
188188

189189
/// The [`i2c::IdTable`] of the corresponding driver.

0 commit comments

Comments
 (0)