Commit 4181aceb authored by Danilo Krummrich's avatar Danilo Krummrich
Browse files

rust: i2c: do not drop device private data on shutdown() 



We must not drop the device private data on shutdown(); none of the
registrations attached to devres that might access the device private
data are released before shutdown() is called.

Hence, freeing the device private data on shutdown() can cause UAF bugs.

Fixes: 57c5bd9a ("rust: i2c: add basic I2C device and driver abstractions")
Acked-by: default avatarAlice Ryhl <aliceryhl@google.com>
Acked-by: default avatarIgor Korotin <igor.korotin.linux@gmail.com>
Link: https://patch.msgid.link/20260107103511.570525-2-dakr@kernel.org


Signed-off-by: default avatarDanilo Krummrich <dakr@kernel.org>
parent 5d9c4c27

rust/kernel/i2c.rs

+2 −2
Original line number Diff line number Diff line
@@ -181,9 +181,9 @@ extern "C" fn shutdown_callback(idev: *mut bindings::i2c_client) { 
        // SAFETY: `shutdown_callback` is only ever called after a successful call to

        // `probe_callback`, hence it's guaranteed that `Device::set_drvdata()` has been called

        // and stored a `Pin<KBox<T>>`.

        let data = unsafe { idev.as_ref().drvdata_obtain::<T>() };

        let data = unsafe { idev.as_ref().drvdata_borrow::<T>() };



        T::shutdown(idev, data.as_ref());

        T::shutdown(idev, data);

    }



    /// The [`i2c::IdTable`] of the corresponding driver.