Re: [PATCH] drm/xe/i2c: Fix use-after-free on driver unload

[Andi Shyti <andi.shyti@kernel.org>]

Hi Balasubramani,

On Fri, Oct 09, 2026 at 10:12:42PM +0530, Balasubramani Vivekanandan wrote:
> The kernel crashes when unloading the xe driver on CRI:
> 
>  Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b73
>  RIP: 0010:platform_device_release+0x80/0x90
>  Call Trace:
>   device_release+0x44/0xa0
>   kobject_put+0x9b/0x250
>   put_device+0x13/0x30
>   platform_device_unregister+0x29/0x40
>   xe_i2c_remove+0x80/0xa0 [xe]
>   devm_action_release+0x16/0x30
>   release_nodes+0x3d/0x140
>   devres_release_all+0x96/0xd0
> 
> This started after commit 0f485f88656af ("drm/xe/i2c: use
> device_create_managed_software_node()"), which attaches a managed
> software node to a platform device created with platform_device_alloc().

...

> We can fix it by removing the dependency on i2c->dev in
> xe_i2c_notifier(). It is using it to match against the right adapter.
> Instead of using the device, use its parent to match.
> 
> Fixes: 0f485f88656af ("drm/xe/i2c: use device_create_managed_software_node()")
> Cc: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> Cc: Danilo Krummrich <dakr@kernel.org>
> Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>

The patch looks fine to me but I still see that there are some
concerns. Like Danilo's points are valid, can those be addressed
later?

For now:

Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>

Let's wait a little and if nothing arises I can apply this for
XE.

Thanks,
Andi