]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
w1: fix NULL pointer dereference in probe
authorChenyuan Yang <chenyuan0y@gmail.com>
Sat, 11 Jan 2025 18:18:03 +0000 (12:18 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Apr 2025 12:39:22 +0000 (14:39 +0200)
commit4f750b84628080ff0d67bf1af67a4967b740acf2
tree82657e9bd88b7660e39cd92098ab9eb21ee998de
parent4baed8d7452ba598b8309b7f0814a8364a7ee2ab
w1: fix NULL pointer dereference in probe

[ Upstream commit 0dd6770a72f138dabea9eae87f3da6ffa68f0d06 ]

The w1_uart_probe() function calls w1_uart_serdev_open() (which includes
devm_serdev_device_open()) before setting the client ops via
serdev_device_set_client_ops(). This ordering can trigger a NULL pointer
dereference in the serdev controller's receive_buf handler, as it assumes
serdev->ops is valid when SERPORT_ACTIVE is set.

This is similar to the issue fixed in commit 5e700b384ec1
("platform/chrome: cros_ec_uart: properly fix race condition") where
devm_serdev_device_open() was called before fully initializing the
device.

Fix the race by ensuring client ops are set before enabling the port via
w1_uart_serdev_open().

Fixes: a3c08804364e ("w1: add UART w1 bus driver")
Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
Acked-by: Christoph Winklhofer <cj.winklhofer@gmail.com>
Link: https://lore.kernel.org/r/20250111181803.2283611-1-chenyuan0y@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/w1/masters/w1-uart.c