github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

i2c: core: fix adapter deregistration race

Browse Source 
Adapters can be looked up by their id using i2c_get_adapter() which
takes a reference to the embedded struct device.

Remove the adapter from the IDR before tearing it down during
deregistration (and on registration failure) to make sure its resources
are not accessed after having been freed (e.g. the device name).

Fixes: 35fc37f818 ("i2c: Limit core locking to the necessary sections")
Cc: stable@vger.kernel.org	# 2.6.31
Cc: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
This commit is contained in:
Johan Hovold 2026-05-11 16:37:13 +02:00 committed by Wolfram Sang
parent ba14d7cf2f
commit b1a58ed9ea
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/i2c/i2c-core-base.c
View File

@ -1587,7 +1587,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
res = device_add(&adap->dev);
if (res) {
pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
goto err_remove_debugfs;
goto err_replace_id;
}
res = i2c_setup_smbus_alert(adap);
@ -1614,7 +1614,10 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
out_reg:
i2c_deregister_clients(adap);
device_del(&adap->dev);
err_remove_debugfs:
err_replace_id:
mutex_lock(&core_lock);
idr_replace(&i2c_adapter_idr, NULL, adap->nr);
mutex_unlock(&core_lock);
debugfs_remove_recursive(adap->debugfs);
pm_runtime_disable(&adap->dev);
err_put_adap:
@ -1804,6 +1807,8 @@ void i2c_del_adapter(struct i2c_adapter *adap)
/* First make sure that this adapter was ever added */
mutex_lock(&core_lock);
found = idr_find(&i2c_adapter_idr, adap->nr);
if (found == adap)
idr_replace(&i2c_adapter_idr, NULL, adap->nr);
mutex_unlock(&core_lock);
if (found != adap) {
pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);