From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6E3F3FE373; Mon, 11 May 2026 14:37:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510244; cv=none; b=qgRF5rxRy9uXhBwEg0KsQxrfDPuAbu4SX1LE1ZKqZDsibRrg07O2cxsq7mvYGbZ93wQbcZlFhEdtaIBqXzGdoHUchwD8AuCyP6cPyIlx1Ld1QuXTwvSEENKLZ4JX4qlGrhgG3SQ8r3UroyOzH2R0PAk/UFMlaugraiYR0G0Msug= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510244; c=relaxed/simple; bh=oaJ1fIHI4x87EvSRfZxR+ViJYFD68Ek/0RZ9v3HJYrw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ShZQbMOTksH8PuwLqlCAgDV12sIHx0QIJsug3zph7nheIdf95qBAbmISFqTHHN8LK9AgHqR1XZmwP1gTfXm78ezUl4KP+0bzqD2SrnABba/aVzQ6DxP48ITuvKUMUBp985GpSKCcAgypLiVJeJqhFnRyGjivSsunrwowYEGpJKI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YtFfAwCu; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YtFfAwCu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9732FC2BCF7; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=oaJ1fIHI4x87EvSRfZxR+ViJYFD68Ek/0RZ9v3HJYrw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YtFfAwCubGBMWV36ZzHJPXjvK00xCSwlQsoD5hOUSz14PmhDGh4SD5+uMZ5wC+USv +Jg/No9SEw5/KpD3L03+LQlsPKlPDyCAXs2U2IACxiMsrZTs9XjF3PMMN5pYFvRwHG PwU5eRPw4XCpHtUij1hB3UTi+4cVbaRFzVwJ1uK3fFcvE9LVumrNMdo3LV0KCuwoAh k8K+m2ljip5RJnSQ/279J6mg7V5l5yy90aLWwjxZbtCzOrfUGOL1wob6Xko6VXs5cP Z6Mj0nFT4MdPZovMW1PFEGLrp03vEmCXZD63Fei1+ZHF02kCKqBsD2Yt7ZORqfWj7q bY9G0euTToX/g== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033qL-10gS; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Jean Delvare Subject: [PATCH v3 08/10] i2c: core: fix adapter deregistration race Date: Mon, 11 May 2026 16:37:13 +0200 Message-ID: <20260511143715.729714-9-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during deregistration (and on registration failure) to make sure its resources are not accessed after having been freed (e.g. the device name). Fixes: 35fc37f81881 ("i2c: Limit core locking to the necessary sections") Cc: stable@vger.kernel.org # 2.6.31 Cc: Jean Delvare Signed-off-by: Johan Hovold --- drivers/i2c/i2c-core-base.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 01a984d3ca0e..38f425aecef8 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1587,7 +1587,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap) res = device_add(&adap->dev); if (res) { pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); - goto err_remove_debugfs; + goto err_replace_id; } res = i2c_setup_smbus_alert(adap); @@ -1614,7 +1614,10 @@ static int i2c_register_adapter(struct i2c_adapter *adap) out_reg: i2c_deregister_clients(adap); device_del(&adap->dev); -err_remove_debugfs: +err_replace_id: + mutex_lock(&core_lock); + idr_replace(&i2c_adapter_idr, NULL, adap->nr); + mutex_unlock(&core_lock); debugfs_remove_recursive(adap->debugfs); pm_runtime_disable(&adap->dev); err_put_adap: @@ -1804,6 +1807,8 @@ void i2c_del_adapter(struct i2c_adapter *adap) /* First make sure that this adapter was ever added */ mutex_lock(&core_lock); found = idr_find(&i2c_adapter_idr, adap->nr); + if (found == adap) + idr_replace(&i2c_adapter_idr, NULL, adap->nr); mutex_unlock(&core_lock); if (found != adap) { pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name); -- 2.53.0