[PATCH V5 07/14] i3c: master: Fix potential UAF in i3c_device_match()

[Alexandre Belloni]

On 07/08/2026 15:43:49-0400, Frank Li wrote:
> On Fri, Aug 07, 2026 at 05:56:31PM +0300, Adrian Hunter wrote:
> > i3c_device_match() dereferences i3cdev->desc without holding the bus
> > normal-use lock.  Since the descriptor pointer can be replaced
> > concurrently, the dereference can race with descriptor replacement and
> > result in a use-after-free.
> >
> > Protect access to i3cdev->desc with the normal-use lock.  While the lock
> > is held, the descriptor is guaranteed to remain valid, so the NULL check
> > is also unnecessary and can be removed.
> >
> > This change depends on "i3c: master: Fix recursive locking during device
> 
> Remove "This change",  just depend on ...
> 
> > registration".  Prior to that change, taking the normal-use lock in
> > i3c_device_match() could recurse on bus->lock during device
> > registration.
> >
> > This fixes "i3c: master: match I3C device through DT and ACPI".
> 
> It should be fixes tag, but this patch still not in linus tree yet, not
> sure how alex handle this.
> 

I've added the Fixes tag, this works as long as the tree isn't rebased
before send the PR to Linus.

> Alex:
> 	Maybe rebase i3c tree,
> 
> move "i3c: master: Fix recursive locking during device" before
> "i3c: master: match I3C device through DT and ACPI"
> 
> Then squash this into "i3c: master: match I3C device through DT and ACPI"
> 
> Or simple ignore "this fixes ..." sentense.
> 
> Reviewed-by: Frank Li <Frank.Li at nxp.com>
> 
> Frank
> 
> >
> > Signed-off-by: Adrian Hunter <adrian.hunter at intel.com>
> > ---
> >
> >
> > Changes in V4 and V5:
> >
> > 	None
> >
> > Changes in V3:
> >
> > 	New patch
> >
> >
> >  drivers/i3c/master.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> > index ee771ac0b203..83e04a2c202a 100644
> > --- a/drivers/i3c/master.c
> > +++ b/drivers/i3c/master.c
> > @@ -347,8 +347,10 @@ static int i3c_device_match(struct device *dev, const struct device_driver *drv)
> >  	i3cdev = dev_to_i3cdev(dev);
> >  	i3cdrv = drv_to_i3cdrv(drv);
> >
> > -	if (i3cdev->desc && i3cdev->desc->boardinfo)
> > +	i3c_bus_normaluse_lock(i3cdev->bus);
> > +	if (i3cdev->desc->boardinfo)
> >  		static_addr_method = i3cdev->desc->boardinfo->static_addr_method;
> > +	i3c_bus_normaluse_unlock(i3cdev->bus);
> >
> >  	/*
> >  	 * SETAASA-based devices need not always have a matching ID since
> > --
> > 2.53.0
> >
> 
> -- 
> linux-i3c mailing list
> linux-i3c at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-i3c

-- 
Alexandre Belloni, co-owner and COO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com