From: Igor Korotin <igor.korotin@linux.dev>
To: "Nicolás Antinori" <nico.antinori.7@gmail.com>
Cc: "Alice Ryhl" <aliceryhl@google.com>,
"Andreas Hindborg" <a.hindborg@kernel.org>,
"Benno Lossin" <lossin@kernel.org>,
"Björn Roy Baron" <bjorn3_gh@protonmail.com>,
"Boqun Feng" <boqun@kernel.org>,
"Daniel Almeida" <daniel.almeida@collabora.com>,
"Danilo Krummrich" <dakr@kernel.org>,
"Gary Guo" <gary@garyguo.net>, "Miguel Ojeda" <ojeda@kernel.org>,
"Trevor Gross" <tmgross@umich.edu>,
"Onur Özkan" <work@onurozkan.dev>,
linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org
Subject: Re: [PATCH v3] i2c: rust: fix I2cAdapter refcounts double increment
Date: Sat, 6 Jun 2026 14:38:04 +0100 [thread overview]
Message-ID: <37ead39b-6b02-4871-afdd-aafce4398175@linux.dev> (raw)
In-Reply-To: <20260531182319.21777-1-nico.antinori.7@gmail.com>
Hello Nicolás
On 5/31/2026 7:23 PM, Nicolás Antinori wrote:
> When `I2cAdapter::get` executes, it first calls
> `bindings::i2c_get_adapter()` which increments the device and module
> reference counts. It then takes a reference to the raw pointer and
> converts it to an `ARef` via `.into()`.
>
> The implementation of `From<&T> for ARef<T>` where `T: AlwaysRefCounted`
> unconditionally calls `T::inc_ref()`. This leads to a second increment
> to the reference counts.
>
> Since the returned `ARef` will only release a single reference when
> dropped via `dec_ref()`, this leaks one device and module reference count
> on every call.
>
> This fix was suggested by sashiko.dev.
>
> Link: https://sashiko.dev/#/patchset/20260521190937.248904-1-nico.antinori.7@gmail.com
> Signed-off-by: Nicolás Antinori <nico.antinori.7@gmail.com>
> ---
> v3:
> - Remove unnecessary `.as_ptr()` and `NonNull` rewrap.
> - Add SAFETY comment for `ARef::from_raw`.
> - Small change in commit message to make it clearer.
> v2:
> - Add missing Link tag to commit message.
> - https://lore.kernel.org/rust-for-linux/20260526194734.14378-1-nico.antinori.7@gmail.com
> v1: https://lore.kernel.org/rust-for-linux/20260524181151.24988-1-nico.antinori.7@gmail.com
>
> rust/kernel/i2c.rs | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/rust/kernel/i2c.rs b/rust/kernel/i2c.rs
> index 7b908f0c5a58..c084a45b1916 100644
> --- a/rust/kernel/i2c.rs
> +++ b/rust/kernel/i2c.rs
> @@ -405,7 +405,9 @@ pub fn get(index: i32) -> Result<ARef<Self>> {
>
> // SAFETY: `adapter` is non-null and points to a live `i2c_adapter`.
> // `I2cAdapter` is #[repr(transparent)], so this cast is valid.
> - Ok(unsafe { (&*adapter.as_ptr().cast::<I2cAdapter<device::Normal>>()).into() })
> + // `i2c_get_adapter` returned the adapter with an incremented refcount, which we pass to
> + // the `ARef`.
> + Ok(unsafe { ARef::from_raw(adapter.cast::<I2cAdapter<device::Normal>>()) })
> }
> }
>
> --
> 2.53.0
>
Reviewed-by: Igor Korotin <igor.korotin@linux.dev>
Cheers
Igor
prev parent reply other threads:[~2026-06-06 13:38 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-31 18:23 [PATCH v3] i2c: rust: fix I2cAdapter refcounts double increment Nicolás Antinori
2026-06-06 13:38 ` Igor Korotin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=37ead39b-6b02-4871-afdd-aafce4398175@linux.dev \
--to=igor.korotin@linux.dev \
--cc=a.hindborg@kernel.org \
--cc=aliceryhl@google.com \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun@kernel.org \
--cc=dakr@kernel.org \
--cc=daniel.almeida@collabora.com \
--cc=gary@garyguo.net \
--cc=linux-kernel@vger.kernel.org \
--cc=lossin@kernel.org \
--cc=nico.antinori.7@gmail.com \
--cc=ojeda@kernel.org \
--cc=rust-for-linux@vger.kernel.org \
--cc=tmgross@umich.edu \
--cc=work@onurozkan.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox