Re: [PATCH] drm/mediatek: mtk_hdmi_common: take i2c adapter module reference

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Double-free of I2C adapter device and module references during driver unbind due to conflicting manual and devm cleanups.
--

--- Patch [1]: [PATCH] drm/mediatek: mtk_hdmi_common: take i2c adapter module reference ---
commit cbad79e276722919c8f55731b14f0b51837c5548
Author: Johan Hovold <johan@kernel.org>

drm/mediatek: mtk_hdmi_common: take i2c adapter module reference

The patch switches to of_get_i2c_adapter_by_node() which grabs a
module reference, allowing graceful module unload failures instead
of uninterruptible blocking. It updates the devm action to call
mtk_hdmi_put_adapter which wraps i2c_put_adapter.

> diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_common.c b/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
> index a049489daa2d7..042b98e5a5199 100644
> --- a/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
> +++ b/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
[ ... ]
> @@ -328,12 +335,12 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, struct platform_device
>  	if (!i2c_np)
>  		return dev_err_probe(dev, -EINVAL, "No ddc-i2c-bus in connector\n");
>  
> -	hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
> +	hdmi->ddc_adpt = of_get_i2c_adapter_by_node(i2c_np);
>  	of_node_put(i2c_np);
>  	if (!hdmi->ddc_adpt)
>  		return dev_err_probe(dev, -EPROBE_DEFER, "Failed to get ddc i2c adapter by node\n");
>  
> -	ret = devm_add_action_or_reset(dev, mtk_hdmi_put_device, &hdmi->ddc_adpt->dev);
> +	ret = devm_add_action_or_reset(dev, mtk_hdmi_put_adapter, hdmi->ddc_adpt);

[Severity: High]
This is a pre-existing issue, but does this devm cleanup conflict with a
manual cleanup during driver unbind?

Looking at mtk_hdmi_v2_remove() in drivers/gpu/drm/mediatek/mtk_hdmi_v2.c,
there is a manual call to i2c_put_adapter(hdmi->ddc_adpt).

When the driver unbinds, mtk_hdmi_v2_remove() will run and release the
adapter. After the remove callback returns, the device core will execute
the devres action registered here. This will invoke mtk_hdmi_put_adapter()
and call i2c_put_adapter() a second time on the same pointer.

Will this result in a double-free of the I2C adapter device and a double
module_put()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716132103.1564995-1-johan@kernel.org?part=1