Re: [PATCH v1] drm/xe/i2c: Disable IRQ on unbind

[Raag Jadav <raag.jadav@intel.com>]

On Fri, Sep 11, 2026 at 01:17:14PM +0200, Heikki Krogerus wrote:
> On Fri, Sep 11, 2026 at 10:10:21AM +0530, Raag Jadav wrote:
> > Currently, struct xe_i2c is freed before SGUnit IRQ is disabled, leaving
> > a potential UAF in case the IRQ is hit in that small window. Explicitly
> > disable I2C IRQ as part of xe_i2c_remove() and fix this.
> > 
> > Fixes: 0bb78ce09926 ("drm/xe/i2c: Wire up reset/postinstall for I2C IRQ")
> > Signed-off-by: Raag Jadav <raag.jadav@intel.com>
> 
> FWIW:
> 
> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

Thanks Heikki. I think I missed cleaning up the i2c dangling pointer here,
let me send out a v2.

Raag

> > ---
> >  drivers/gpu/drm/xe/xe_i2c.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/drivers/gpu/drm/xe/xe_i2c.c b/drivers/gpu/drm/xe/xe_i2c.c
> > index d8fa68206f41..82b22c5412ba 100644
> > --- a/drivers/gpu/drm/xe/xe_i2c.c
> > +++ b/drivers/gpu/drm/xe/xe_i2c.c
> > @@ -324,8 +324,10 @@ void xe_i2c_pm_resume(struct xe_device *xe, bool d3cold)
> >  static void xe_i2c_remove(void *data)
> >  {
> >  	struct xe_i2c *i2c = data;
> > +	struct xe_device *xe = tile_to_xe(i2c->mmio->tile);
> >  	unsigned int i;
> >  
> > +	xe_i2c_irq_reset(xe);
> >  	xe_amc_exit(i2c);
> >  
> >  	for (i = 0; i < XE_I2C_MAX_CLIENTS; i++) {
> > -- 
> > 2.43.0
> 
> -- 
> heikki