[PATCH] drm/mediatek: mtk_hdmi_common: take i2c adapter module reference

[PATCH] drm/mediatek: mtk_hdmi_common: take i2c adapter module reference

[Johan Hovold]

The i2c subsystem currently blocks during adapter deregistration
whenever there are consumers holding a reference.

Switch to using of_get_i2c_adapter_by_node() which also takes a
reference to the adapter module so that an attempt to unload the module
while in use fails gracefully instead of blocking uninterruptibly.

Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/gpu/drm/mediatek/mtk_hdmi_common.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_common.c b/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
index a049489daa2d..042b98e5a519 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
@@ -290,6 +290,13 @@ static int mtk_hdmi_get_cec_dev(struct mtk_hdmi *hdmi, struct device *dev, struc
 	return 0;
 }
 
+static void mtk_hdmi_put_adapter(void *_adap)
+{
+	struct i2c_adapter *adap = _adap;
+
+	i2c_put_adapter(adap);
+}
+
 static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, struct platform_device *pdev,
 				   const char * const *clk_names, size_t num_clocks)
 {
@@ -328,12 +335,12 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, struct platform_device
 	if (!i2c_np)
 		return dev_err_probe(dev, -EINVAL, "No ddc-i2c-bus in connector\n");
 
-	hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
+	hdmi->ddc_adpt = of_get_i2c_adapter_by_node(i2c_np);
 	of_node_put(i2c_np);
 	if (!hdmi->ddc_adpt)
 		return dev_err_probe(dev, -EPROBE_DEFER, "Failed to get ddc i2c adapter by node\n");
 
-	ret = devm_add_action_or_reset(dev, mtk_hdmi_put_device, &hdmi->ddc_adpt->dev);
+	ret = devm_add_action_or_reset(dev, mtk_hdmi_put_adapter, hdmi->ddc_adpt);
 	if (ret)
 		return ret;
 
-- 
2.54.0

Re: [PATCH] drm/mediatek: mtk_hdmi_common: take i2c adapter module reference

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Double-free of I2C adapter device and module references during driver unbind due to conflicting manual and devm cleanups.
--

--- Patch [1]: [PATCH] drm/mediatek: mtk_hdmi_common: take i2c adapter module reference ---
commit cbad79e276722919c8f55731b14f0b51837c5548
Author: Johan Hovold <johan@kernel.org>

drm/mediatek: mtk_hdmi_common: take i2c adapter module reference

The patch switches to of_get_i2c_adapter_by_node() which grabs a
module reference, allowing graceful module unload failures instead
of uninterruptible blocking. It updates the devm action to call
mtk_hdmi_put_adapter which wraps i2c_put_adapter.

> diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_common.c b/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
> index a049489daa2d7..042b98e5a5199 100644
> --- a/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
> +++ b/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
[ ... ]
> @@ -328,12 +335,12 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, struct platform_device
>  	if (!i2c_np)
>  		return dev_err_probe(dev, -EINVAL, "No ddc-i2c-bus in connector\n");
>  
> -	hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
> +	hdmi->ddc_adpt = of_get_i2c_adapter_by_node(i2c_np);
>  	of_node_put(i2c_np);
>  	if (!hdmi->ddc_adpt)
>  		return dev_err_probe(dev, -EPROBE_DEFER, "Failed to get ddc i2c adapter by node\n");
>  
> -	ret = devm_add_action_or_reset(dev, mtk_hdmi_put_device, &hdmi->ddc_adpt->dev);
> +	ret = devm_add_action_or_reset(dev, mtk_hdmi_put_adapter, hdmi->ddc_adpt);

[Severity: High]
This is a pre-existing issue, but does this devm cleanup conflict with a
manual cleanup during driver unbind?

Looking at mtk_hdmi_v2_remove() in drivers/gpu/drm/mediatek/mtk_hdmi_v2.c,
there is a manual call to i2c_put_adapter(hdmi->ddc_adpt).

When the driver unbinds, mtk_hdmi_v2_remove() will run and release the
adapter. After the remove callback returns, the device core will execute
the devres action registered here. This will invoke mtk_hdmi_put_adapter()
and call i2c_put_adapter() a second time on the same pointer.

Will this result in a double-free of the I2C adapter device and a double
module_put()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716132103.1564995-1-johan@kernel.org?part=1