Re: [PATCH] drm/xe/i2c: Fix use-after-free on driver unload

Re: [PATCH] drm/xe/i2c: Fix use-after-free on driver unload

[Danilo Krummrich]

(Cc: i2c, driver-core)

On Fri Oct 9, 2026 at 6:42 PM CEST, Balasubramani Vivekanandan wrote:
> The kernel crashes when unloading the xe driver on CRI:
>
>  Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b73
>  RIP: 0010:platform_device_release+0x80/0x90
>  Call Trace:
>   device_release+0x44/0xa0
>   kobject_put+0x9b/0x250
>   put_device+0x13/0x30
>   platform_device_unregister+0x29/0x40
>   xe_i2c_remove+0x80/0xa0 [xe]
>   devm_action_release+0x16/0x30
>   release_nodes+0x3d/0x140
>   devres_release_all+0x96/0xd0
>
> This started after commit 0f485f88656af ("drm/xe/i2c: use
> device_create_managed_software_node()"), which attaches a managed
> software node to a platform device created with platform_device_alloc().
>
> Comment above the device_create_managed_software_node function cautions
> that the software node created by it should not be shared or reused as
> the lifetime of the node is linked to the device.

Yes, it does not distinguish between provider and consumer and hence always
calls swnode_put() in the managed path of software_node_notify_remove().

This seems to be a bit of a footgun, and I think we should address this.

> But the DesignWare i2c driver which creates an adapter device as a child
> of the platform device reuses the software node as its fwnode.
> (device_set_node() in i2c_dw_probe()).
>
> During module unbind, when the adapter device is deleted, it drops the
> reference count for the software node and frees the software node.
> Later when the platform device is removed, it tries to dereference the
> software node pointer and results in use-after-free.
>
> Instead of managed software node use a static struct software_node
> passed through platform_device_info.swnode to
> platform_device_register_full().
> But we have a blocker which doesn't allow to use
> platform_device_register_full() simply.

I think this works out as the I2C adapter and hence its children are destroyed
when the platform device is unregistered.

But also note that technically this approach has some friction in its lifetime
model: The software node pointer stored only lives as long as the Xe module and
becomes invalid after module unload. The structures this pointer is shared with
are reference counted though and could technically be longer lived.

Thanks,
Danilo

Re: [PATCH] drm/xe/i2c: Fix use-after-free on driver unload

[Vivekanandan, Balasubramani]

On 10.10.2026 22:14, Danilo Krummrich wrote:
> (Cc: i2c, driver-core)
> 
> On Fri Oct 9, 2026 at 6:42 PM CEST, Balasubramani Vivekanandan wrote:
> > The kernel crashes when unloading the xe driver on CRI:
> >
> >  Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b73
> >  RIP: 0010:platform_device_release+0x80/0x90
> >  Call Trace:
> >   device_release+0x44/0xa0
> >   kobject_put+0x9b/0x250
> >   put_device+0x13/0x30
> >   platform_device_unregister+0x29/0x40
> >   xe_i2c_remove+0x80/0xa0 [xe]
> >   devm_action_release+0x16/0x30
> >   release_nodes+0x3d/0x140
> >   devres_release_all+0x96/0xd0
> >
> > This started after commit 0f485f88656af ("drm/xe/i2c: use
> > device_create_managed_software_node()"), which attaches a managed
> > software node to a platform device created with platform_device_alloc().
> >
> > Comment above the device_create_managed_software_node function cautions
> > that the software node created by it should not be shared or reused as
> > the lifetime of the node is linked to the device.
> 
> Yes, it does not distinguish between provider and consumer and hence always
> calls swnode_put() in the managed path of software_node_notify_remove().
> 
> This seems to be a bit of a footgun, and I think we should address this.
> 
> > But the DesignWare i2c driver which creates an adapter device as a child
> > of the platform device reuses the software node as its fwnode.
> > (device_set_node() in i2c_dw_probe()).
> >
> > During module unbind, when the adapter device is deleted, it drops the
> > reference count for the software node and frees the software node.
> > Later when the platform device is removed, it tries to dereference the
> > software node pointer and results in use-after-free.
> >
> > Instead of managed software node use a static struct software_node
> > passed through platform_device_info.swnode to
> > platform_device_register_full().
> > But we have a blocker which doesn't allow to use
> > platform_device_register_full() simply.
> 
> I think this works out as the I2C adapter and hence its children are destroyed
> when the platform device is unregistered.
> 
> But also note that technically this approach has some friction in its lifetime
> model: The software node pointer stored only lives as long as the Xe module and
> becomes invalid after module unload. The structures this pointer is shared with
> are reference counted though and could technically be longer lived.

Agree that it is technically possible. Apart from Designware i2c driver,
no other driver is sharing this software node. Xe module removes the
platform device during unload and it leads to Designware i2c driver
unbound from the platform device. At this stage, all reference held by
i2c driver on software node are released.

We can switch back to the managed software node once the above issue is
addressed.

Regards,
Bala

> 
> Thanks,
> Danilo