diff mbox series

[v3,08/10] i2c: core: fix adapter deregistration race

Message ID 20260511143715.729714-9-johan@kernel.org
State Accepted
Delegated to: Wolfram Sang
Headers show
Series i2c: core: adapter registration fixes | expand

Commit Message

Johan Hovold May 11, 2026, 2:37 p.m. UTC 
Adapters can be looked up by their id using i2c_get_adapter() which
takes a reference to the embedded struct device.

Remove the adapter from the IDR before tearing it down during
deregistration (and on registration failure) to make sure its resources
are not accessed after having been freed (e.g. the device name).

Fixes: 35fc37f81881 ("i2c: Limit core locking to the necessary sections")
Cc: stable@vger.kernel.org	# 2.6.31
Cc: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/i2c/i2c-core-base.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

Comments

Wolfram Sang June 4, 2026, 8:50 a.m. UTC | #1 
On Mon, May 11, 2026 at 04:37:13PM +0200, Johan Hovold wrote:
> Adapters can be looked up by their id using i2c_get_adapter() which
> takes a reference to the embedded struct device.
> 
> Remove the adapter from the IDR before tearing it down during
> deregistration (and on registration failure) to make sure its resources
> are not accessed after having been freed (e.g. the device name).
> 
> Fixes: 35fc37f81881 ("i2c: Limit core locking to the necessary sections")
> Cc: stable@vger.kernel.org	# 2.6.31
> Cc: Jean Delvare <khali@linux-fr.org>
> Signed-off-by: Johan Hovold <johan@kernel.org>

Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
diff mbox series

Patch

diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 01a984d3ca0e..38f425aecef8 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1587,7 +1587,7 @@  static int i2c_register_adapter(struct i2c_adapter *adap)
 	res = device_add(&adap->dev);
 	if (res) {
 		pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
-		goto err_remove_debugfs;
+		goto err_replace_id;
 	}
 
 	res = i2c_setup_smbus_alert(adap);
@@ -1614,7 +1614,10 @@  static int i2c_register_adapter(struct i2c_adapter *adap)
 out_reg:
 	i2c_deregister_clients(adap);
 	device_del(&adap->dev);
-err_remove_debugfs:
+err_replace_id:
+	mutex_lock(&core_lock);
+	idr_replace(&i2c_adapter_idr, NULL, adap->nr);
+	mutex_unlock(&core_lock);
 	debugfs_remove_recursive(adap->debugfs);
 	pm_runtime_disable(&adap->dev);
 err_put_adap:
@@ -1804,6 +1807,8 @@  void i2c_del_adapter(struct i2c_adapter *adap)
 	/* First make sure that this adapter was ever added */
 	mutex_lock(&core_lock);
 	found = idr_find(&i2c_adapter_idr, adap->nr);
+	if (found == adap)
+		idr_replace(&i2c_adapter_idr, NULL, adap->nr);
 	mutex_unlock(&core_lock);
 	if (found != adap) {
 		pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);