[PATCH v2] drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2

[PATCH v2] drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2

[Guangshuo Li]

mtk_hdmi_common_probe() gets the DDC adapter with
of_find_i2c_adapter_by_node() and registers a devm action to release the
adapter device reference with put_device().

The HDMI v2 remove callback also calls i2c_put_adapter() on the same DDC
adapter. This is not paired with of_find_i2c_adapter_by_node(): it drops
the adapter device reference before the devm action drops it again, and
it also puts a module reference that was never taken.

Remove the extra i2c_put_adapter() call and drop the now-empty HDMI v2
remove callback. The common devm action releases the adapter device
reference.

Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
v2:
  - Drop the empty remove callback, as suggested by Johan Hovold.
  - Mention that i2c_put_adapter() also drops a module reference that was
    never taken.
  - Fix the Fixes tag.
  - Add Cc stable.

 drivers/gpu/drm/mediatek/mtk_hdmi_v2.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_v2.c b/drivers/gpu/drm/mediatek/mtk_hdmi_v2.c
index 7bbf463056c9..ffe456238a2b 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi_v2.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi_v2.c
@@ -1499,13 +1499,6 @@ static int mtk_hdmi_v2_probe(struct platform_device *pdev)
 	return 0;
 }
 
-static void mtk_hdmi_v2_remove(struct platform_device *pdev)
-{
-	struct mtk_hdmi *hdmi = platform_get_drvdata(pdev);
-
-	i2c_put_adapter(hdmi->ddc_adpt);
-}
-
 static const struct of_device_id mtk_drm_hdmi_v2_of_ids[] = {
 	{ .compatible = "mediatek,mt8188-hdmi-tx", .data = &mtk_hdmi_conf_mt8188 },
 	{ .compatible = "mediatek,mt8195-hdmi-tx", .data = &mtk_hdmi_conf_mt8195 },
@@ -1515,7 +1508,6 @@ MODULE_DEVICE_TABLE(of, mtk_drm_hdmi_v2_of_ids);
 
 static struct platform_driver mtk_hdmi_v2_driver = {
 	.probe = mtk_hdmi_v2_probe,
-	.remove = mtk_hdmi_v2_remove,
 	.driver = {
 		.name = "mediatek-drm-hdmi-v2",
 		.of_match_table = mtk_drm_hdmi_v2_of_ids,
-- 
2.43.0

Re: [PATCH v2] drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The HDMI driver acquires the DDC I2C adapter using `of_find_i2c_adapter_by_node()`, which takes a device reference but not a module reference. This allows a privileged user to unload the I2C adapter module while it is still in use, leading to a deadlock during module removal.
--

commit c9e2f0cee6fea92e4b3c20dab0df7308240a2d76
Author: Guangshuo Li <lgs201920130244@gmail.com>

drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2

This commit removes the extra i2c_put_adapter() call in the HDMI v2
remove callback to prevent a double put of the DDC adapter device
reference. The reference is managed by a devm action set up during probe.

> mtk_hdmi_common_probe() gets the DDC adapter with
> of_find_i2c_adapter_by_node() and registers a devm action to release the
> adapter device reference with put_device().
> 
> The HDMI v2 remove callback also calls i2c_put_adapter() on the same DDC
> adapter. This is not paired with of_find_i2c_adapter_by_node(): it drops
> the adapter device reference before the devm action drops it again, and
> it also puts a module reference that was never taken.

[Severity: High]
This is a pre-existing issue, but does using of_find_i2c_adapter_by_node()
leave the driver vulnerable to a deadlock?

Since of_find_i2c_adapter_by_node() takes a device reference but not a
module reference, it seems a privileged user could unload the I2C adapter
module (e.g., rmmod i2c_mt65xx) or unbind it via sysfs while the mtk_hdmi
driver is still using it.

If that happens, will the I2C core's i2c_del_adapter() wait indefinitely for
the device reference to reach zero, causing a deadlock and hanging the
unload process?

Code snippet for reference from drivers/gpu/drm/mediatek/mtk_hdmi_common.c:

mtk_hdmi_dt_parse_pdata() {
    ...
    hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
    ...
}

Would it be safer to migrate this to of_get_i2c_adapter_by_node() and
pair it with i2c_put_adapter() in the devm cleanup action, so that the
module reference is properly held?

> Remove the extra i2c_put_adapter() call and drop the now-empty HDMI v2
> remove callback. The common devm action releases the adapter device
> reference.
>
> Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

> diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_v2.c b/drivers/gpu/drm/mediatek/mtk_hdmi_v2.c
> index 7bbf463056c95..ffe456238a2bf 100644
> --- a/drivers/gpu/drm/mediatek/mtk_hdmi_v2.c
> +++ b/drivers/gpu/drm/mediatek/mtk_hdmi_v2.c
[ ... ]
> @@ -1499,13 +1499,6 @@ static int mtk_hdmi_v2_probe(struct platform_device *pdev)
>  	return 0;
>  }
>  
> -static void mtk_hdmi_v2_remove(struct platform_device *pdev)
> -{
> -	struct mtk_hdmi *hdmi = platform_get_drvdata(pdev);
> -
> -	i2c_put_adapter(hdmi->ddc_adpt);
> -}
> -

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706015507.453222-1-lgs201920130244@gmail.com?part=1

Re: [PATCH v2] drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2

[Johan Hovold]

On Mon, Jul 06, 2026 at 09:55:07AM +0800, Guangshuo Li wrote:
> mtk_hdmi_common_probe() gets the DDC adapter with
> of_find_i2c_adapter_by_node() and registers a devm action to release the
> adapter device reference with put_device().
> 
> The HDMI v2 remove callback also calls i2c_put_adapter() on the same DDC
> adapter. This is not paired with of_find_i2c_adapter_by_node(): it drops
> the adapter device reference before the devm action drops it again, and
> it also puts a module reference that was never taken.
> 
> Remove the extra i2c_put_adapter() call and drop the now-empty HDMI v2
> remove callback. The common devm action releases the adapter device
> reference.
> 
> Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
> v2:
>   - Drop the empty remove callback, as suggested by Johan Hovold.
>   - Mention that i2c_put_adapter() also drops a module reference that was
>     never taken.
>   - Fix the Fixes tag.
>   - Add Cc stable.

Please remember to CC reviewers:

Reviewed-by: Johan Hovold <johan@kernel.org>