From: Igor Korotin <igor.korotin@linux.dev>
To: "Nicolás Antinori" <nico.antinori.7@gmail.com>
Cc: "Alice Ryhl" <aliceryhl@google.com>,
"Andreas Hindborg" <a.hindborg@kernel.org>,
"Benno Lossin" <lossin@kernel.org>,
"Björn Roy Baron" <bjorn3_gh@protonmail.com>,
"Boqun Feng" <boqun@kernel.org>,
"Daniel Almeida" <daniel.almeida@collabora.com>,
"Danilo Krummrich" <dakr@kernel.org>,
"Gary Guo" <gary@garyguo.net>, "Miguel Ojeda" <ojeda@kernel.org>,
"Trevor Gross" <tmgross@umich.edu>,
"Onur Özkan" <work@onurozkan.dev>,
linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org
Subject: Re: [PATCH v3] i2c: rust: fix I2cAdapter refcounts double increment
Date: Sat, 6 Jun 2026 14:38:04 +0100 [thread overview]
Message-ID: <37ead39b-6b02-4871-afdd-aafce4398175@linux.dev> (raw)
In-Reply-To: <20260531182319.21777-1-nico.antinori.7@gmail.com>
Hello Nicolás
On 5/31/2026 7:23 PM, Nicolás Antinori wrote:
> When `I2cAdapter::get` executes, it first calls
> `bindings::i2c_get_adapter()` which increments the device and module
> reference counts. It then takes a reference to the raw pointer and
> converts it to an `ARef` via `.into()`.
>
> The implementation of `From<&T> for ARef<T>` where `T: AlwaysRefCounted`
> unconditionally calls `T::inc_ref()`. This leads to a second increment
> to the reference counts.
>
> Since the returned `ARef` will only release a single reference when
> dropped via `dec_ref()`, this leaks one device and module reference count
> on every call.
>
> This fix was suggested by sashiko.dev.
>
> Link: https://sashiko.dev/#/patchset/20260521190937.248904-1-nico.antinori.7@gmail.com
> Signed-off-by: Nicolás Antinori <nico.antinori.7@gmail.com>
> ---
> v3:
> - Remove unnecessary `.as_ptr()` and `NonNull` rewrap.
> - Add SAFETY comment for `ARef::from_raw`.
> - Small change in commit message to make it clearer.
> v2:
> - Add missing Link tag to commit message.
> - https://lore.kernel.org/rust-for-linux/20260526194734.14378-1-nico.antinori.7@gmail.com
> v1: https://lore.kernel.org/rust-for-linux/20260524181151.24988-1-nico.antinori.7@gmail.com
>
> rust/kernel/i2c.rs | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/rust/kernel/i2c.rs b/rust/kernel/i2c.rs
> index 7b908f0c5a58..c084a45b1916 100644
> --- a/rust/kernel/i2c.rs
> +++ b/rust/kernel/i2c.rs
> @@ -405,7 +405,9 @@ pub fn get(index: i32) -> Result<ARef<Self>> {
>
> // SAFETY: `adapter` is non-null and points to a live `i2c_adapter`.
> // `I2cAdapter` is #[repr(transparent)], so this cast is valid.
> - Ok(unsafe { (&*adapter.as_ptr().cast::<I2cAdapter<device::Normal>>()).into() })
> + // `i2c_get_adapter` returned the adapter with an incremented refcount, which we pass to
> + // the `ARef`.
> + Ok(unsafe { ARef::from_raw(adapter.cast::<I2cAdapter<device::Normal>>()) })
> }
> }
>
> --
> 2.53.0
>
Reviewed-by: Igor Korotin <igor.korotin@linux.dev>
Cheers
Igor
prev parent reply other threads:[~2026-06-06 13:39 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-31 18:23 [PATCH v3] i2c: rust: fix I2cAdapter refcounts double increment Nicolás Antinori
2026-06-06 13:38 ` Igor Korotin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=37ead39b-6b02-4871-afdd-aafce4398175@linux.dev \
--to=igor.korotin@linux.dev \
--cc=a.hindborg@kernel.org \
--cc=aliceryhl@google.com \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun@kernel.org \
--cc=dakr@kernel.org \
--cc=daniel.almeida@collabora.com \
--cc=gary@garyguo.net \
--cc=linux-kernel@vger.kernel.org \
--cc=lossin@kernel.org \
--cc=nico.antinori.7@gmail.com \
--cc=ojeda@kernel.org \
--cc=rust-for-linux@vger.kernel.org \
--cc=tmgross@umich.edu \
--cc=work@onurozkan.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.