Messages in this thread | | | Date | Tue, 14 Jun 2022 21:45:42 +0200 | From | Wolfram Sang <> | Subject | Re: [PATCH] i2c: core: fix potential use-after-free on adapter removal |
| |
Hi Michał,
I finally had a look at your patch...
> put_device(&adap->dev) might free the memory pointed to by `adap`, > so we shouldn't read adap->owner after that. > > Fix by saving module pointer before calling put_device().
... and found a different approach for this problem from 2019:
http://patchwork.ozlabs.org/project/linux-i2c/patch/1577439272-10362-1-git-send-email-vulab@iscas.ac.cn/
I think this is also proper. I found other subsystems in the kernel first putting the module, then the device. Do you see problems with the above patch?
Thanks for looking into the issue!
Wolfram
> > Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl> > --- > drivers/i2c/i2c-core-base.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c > index 2c59dd748a49..5d694f8ce9ef 100644 > --- a/drivers/i2c/i2c-core-base.c > +++ b/drivers/i2c/i2c-core-base.c > @@ -2464,11 +2464,14 @@ EXPORT_SYMBOL(i2c_get_adapter); > > void i2c_put_adapter(struct i2c_adapter *adap) > { > + struct module *owner; > + > if (!adap) > return; > > + owner = adap->owner; > put_device(&adap->dev); > - module_put(adap->owner); > + module_put(owner); > } > EXPORT_SYMBOL(i2c_put_adapter); > > -- > 2.30.2 > [unhandled content-type:application/pgp-signature] | |