linux-kernel - [PATCH 1/6] rust: i2c: do not drop device private data on shutdown()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260107103511.570525-2-dakr@kernel.org>
Date: Wed,  7 Jan 2026 11:35:00 +0100
From: Danilo Krummrich <dakr@...nel.org>
To: gregkh@...uxfoundation.org,
	rafael@...nel.org,
	igor.korotin.linux@...il.com,
	ojeda@...nel.org,
	boqun.feng@...il.com,
	gary@...yguo.net,
	bjorn3_gh@...tonmail.com,
	lossin@...nel.org,
	a.hindborg@...nel.org,
	aliceryhl@...gle.com,
	tmgross@...ch.edu,
	david.m.ertman@...el.com,
	ira.weiny@...el.com,
	leon@...nel.org,
	bhelgaas@...gle.com,
	kwilczynski@...nel.org,
	wsa+renesas@...g-engineering.com
Cc: linux-kernel@...r.kernel.org,
	rust-for-linux@...r.kernel.org,
	linux-pci@...r.kernel.org,
	linux-usb@...r.kernel.org,
	linux-i2c@...r.kernel.org,
	Danilo Krummrich <dakr@...nel.org>
Subject: [PATCH 1/6] rust: i2c: do not drop device private data on shutdown()

We must not drop the device private data on shutdown(); none of the
registrations attached to devres that might access the device private
data are released before shutdown() is called.

Hence, freeing the device private data on shutdown() can cause UAF bugs.

Fixes: 57c5bd9aee94 ("rust: i2c: add basic I2C device and driver abstractions")
Signed-off-by: Danilo Krummrich <dakr@...nel.org>
---
 rust/kernel/i2c.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rust/kernel/i2c.rs b/rust/kernel/i2c.rs
index 491e6cc25cf4..35b678b78d91 100644
--- a/rust/kernel/i2c.rs
+++ b/rust/kernel/i2c.rs
@@ -181,9 +181,9 @@ extern "C" fn shutdown_callback(idev: *mut bindings::i2c_client) {
         // SAFETY: `shutdown_callback` is only ever called after a successful call to
         // `probe_callback`, hence it's guaranteed that `Device::set_drvdata()` has been called
         // and stored a `Pin<KBox<T>>`.
-        let data = unsafe { idev.as_ref().drvdata_obtain::<T>() };
+        let data = unsafe { idev.as_ref().drvdata_borrow::<T>() };
 
-        T::shutdown(idev, data.as_ref());
+        T::shutdown(idev, data);
     }
 
     /// The [`i2c::IdTable`] of the corresponding driver.
-- 
2.52.0