kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/w1/masters
History
Chenyuan Yang 4f750b8462 w1: fix NULL pointer dereference in probe 
[ Upstream commit 0dd6770a72 ]

The w1_uart_probe() function calls w1_uart_serdev_open() (which includes
devm_serdev_device_open()) before setting the client ops via
serdev_device_set_client_ops(). This ordering can trigger a NULL pointer
dereference in the serdev controller's receive_buf handler, as it assumes
serdev->ops is valid when SERPORT_ACTIVE is set.

This is similar to the issue fixed in commit 5e700b384e
("platform/chrome: cros_ec_uart: properly fix race condition") where
devm_serdev_device_open() was called before fully initializing the
device.

Fix the race by ensuring client ops are set before enabling the port via
w1_uart_serdev_open().

Fixes: a3c0880436 ("w1: add UART w1 bus driver")
Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
Acked-by: Christoph Winklhofer <cj.winklhofer@gmail.com>
Link: https://lore.kernel.org/r/20250111181803.2283611-1-chenyuan0y@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-04-10 14:39:22 +02:00
..
amd_axi_w1.c w1: amd_axi_w1: Explicitly include correct DT includes 2023-12-08 08:35:25 +01:00
ds2482.c w1: ds2482: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-09-06 19:18:32 +02:00
ds2490.c w1: ds2490: support block sizes larger than 128 bytes in ds_read_block 2023-12-20 09:25:23 +01:00
Kconfig w1: add UART w1 bus driver 2024-02-15 15:02:33 +01:00
Makefile w1: add UART w1 bus driver 2024-02-15 15:02:33 +01:00
matrox_w1.c w1: matrox: remove unnecessary ENOMEM messages 2023-04-20 14:15:07 +02:00
mxc_w1.c w1: mxc_w1: Convert to platform remove callback returning void 2024-02-20 11:24:33 +01:00
omap_hdq.c w1: omap_hdq: Convert to platform remove callback returning void 2024-02-20 11:24:33 +01:00
sgi_w1.c w1: sgi_w1: Convert to platform remove callback returning void 2024-02-20 11:24:34 +01:00
w1-gpio.c w1: gpio: Don't use "proxy" headers 2024-03-25 12:06:37 +01:00
w1-uart.c w1: fix NULL pointer dereference in probe 2025-04-10 14:39:22 +02:00