From nobody Sat Jun 13 01:41:35 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CB9F3FE67E; Mon, 11 May 2026 14:37:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; cv=none; b=NaEyckNlXc9+mkt38AOv03QoyuNW0CGAJicFj+vB57gvmyF/wA+EnLgc/af1mmEAh9CCDebe+1moVu2Tdo1HeEpl0s1m+CV3zUlybT2he3fsmCK8mYjUU8SYGhSyj0zZ6piD6xzJTSr3gC+jFHi75NBgx4L/uZb5NITsiw0m06U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; c=relaxed/simple; bh=Syz9agCjo0v7ek7ZUl8IDRv5CIYKzs5t99pAAWh8o7Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=a11lgylY7ozmqth5iUcD0+wboY16FZoc0G+0PVaGFzAihbiGNI4TTD0Qj8BSyEOZfSyXo08Qxv6AN5vYeLpKGKuTzj/kML2gT+xcXLOqjuY/E4ok5Zk6fR/21SfA25mdIa7fJTd8MwVal/+H/RHaTSTY4MwQ/Wj9eUT0/AwS8lA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=iJgBLbhC; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="iJgBLbhC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9BD34C4AF0B; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=Syz9agCjo0v7ek7ZUl8IDRv5CIYKzs5t99pAAWh8o7Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iJgBLbhCrwBKgY2hvKQvF238S4Zu3IsuatUk/oA1J//26H3DodD048y4pTQtCqry7 p3reXAdUmgSTcBIzCylZaez5P6PL0KXDHTRxZP8+keH1K1xYws0vqIupd4Ds9NRu8L 3jsAO3Wvik3ouQbrc66iVMDthdFiNUDFrFXgr05K0DIrS2spu/JhVKWx0+Z7JENA7h 1AjGNyQbKtIe9UYqjn9rMCA9mVK2tDT8nsZZ/MND7Xxbl5b9CXDgFExzwGMxOc25x/ gRABapJILGgm7JGvWOqy+J1eaeeNKElw+HJYz9utGQJEPqD85aenaXtkxGw9roKmxH P5gkpUnZ5ItHQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033q7-0cpH; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Benjamin Tissoires Subject: [PATCH v3 01/10] i2c: core: fix irq domain leak on adapter registration failure Date: Mon, 11 May 2026 16:37:06 +0200 Message-ID: <20260511143715.729714-2-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to tear down the host notify irq domain on adapter registration failure to avoid leaking it. This issue was flagged by Sashiko when reviewing another adapter registration fix. Fixes: 4d5538f5882a ("i2c: use an IRQ to report Host Notify events, not ale= rt") Cc: stable@vger.kernel.org # 4.10 Cc: Benjamin Tissoires Signed-off-by: Johan Hovold Reviewed-by: Wolfram Sang --- drivers/i2c/i2c-core-base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 9c46147e3506..abe8341c1d6e 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1574,7 +1574,7 @@ static int i2c_register_adapter(struct i2c_adapter *a= dap) if (res) { pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); put_device(&adap->dev); - goto out_list; + goto err_remove_irq_domain; } =20 adap->debugfs =3D debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_ro= ot); @@ -1609,6 +1609,8 @@ static int i2c_register_adapter(struct i2c_adapter *a= dap) init_completion(&adap->dev_released); device_unregister(&adap->dev); wait_for_completion(&adap->dev_released); +err_remove_irq_domain: + i2c_host_notify_irq_teardown(adap); out_list: mutex_lock(&core_lock); idr_remove(&i2c_adapter_idr, adap->nr); --=20 2.53.0 From nobody Sat Jun 13 01:41:35 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 195B53FF882; Mon, 11 May 2026 14:37:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; cv=none; b=inqDCc0UL4NA7o0K99cjBGUZCxfUOeAgMAHIJx7yTrRAWl71XktlrGY0JRCWev22nzP7hmrkPLBeyxpJ1wF2qKsLnr/ZfBu8SljILlkN6RamRPpU0Fo4qNbj33oSiy6Tn9fGooyRc8YZI+E4ERfgZPKGiEZEMnZFPJMJE2rKc40= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; c=relaxed/simple; bh=iWOJMFzk81mc01UCHmR2eS+IPYYYlYe4517FrK8gdpc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Hh7uYnry6N7ZiK+X11tk4AzGa6XfVGwwkwyDD8+qBRPjBVkviQR/Fa9X5UGON8lkziJtUc/YBLr5Smu3HINUd4K2v/555NWqtub+Lv2+k/SJdSsUzTZbtaHa809tgsFw4SdX923WsGQupVtFV7Kq4S5pSZWugWaDJFoaNoe2SbE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XjexF/2K; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XjexF/2K" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A1C11C2BCFD; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=iWOJMFzk81mc01UCHmR2eS+IPYYYlYe4517FrK8gdpc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XjexF/2KAd2aC8Bd6AyqBMaQF0YFEaSHE9j2b0bPWrs7WA0fswIQnLeFRn2x7O3Qs JzMRjN6ihFfHkwZKWpRQehd6zyXIUsuQdJcrqVtKSkcRYC/MAphhIBfojbr3RiEjhE XDxzXUZhaC/SMbtGKKwCC8n6wCOeuUumrXvqMehvfwhvfkyo7jWaWUIsipnRdn4TBB 5pbw33NHBlnvh9vOqInw1u7HbXsR/1kKNXFGs7t1OJ1Xjkyz45JjU9M4mEToAezxvV UIrmZdpk7teLjQYGtMVVIPunoicYmN2RI9IUhlHAZrhbDthhIXrQc83ynaCic4mgmi bE2rkU6mITqYQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033q9-0gaw; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Phil Reid Subject: [PATCH v3 02/10] i2c: core: fix hang on adapter registration failure Date: Mon, 11 May 2026 16:37:07 +0200 Message-ID: <20260511143715.729714-3-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Clients may be registered from bus notifier callbacks when the adapter is registered. On a subsequent error during registration, the adapter references taken by such clients prevent the wait for the references to be released from ever completing. Fix this by refactoring client deregistration and deregistering also on late adapter registration failures. Fixes: f8756c67b3de ("i2c: core: call of_i2c_setup_smbus_alert in i2c_regis= ter_adapter") Cc: stable@vger.kernel.org # 4.15 Cc: Phil Reid Signed-off-by: Johan Hovold Reviewed-by: Wolfram Sang --- drivers/i2c/i2c-core-base.c | 49 ++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 20 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index abe8341c1d6e..e42851a10098 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -63,6 +63,7 @@ static DEFINE_MUTEX(core_lock); static DEFINE_IDR(i2c_adapter_idr); =20 +static void i2c_deregister_clients(struct i2c_adapter *adap); static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driv= er); =20 static DEFINE_STATIC_KEY_FALSE(i2c_trace_msg_key); @@ -1605,6 +1606,7 @@ static int i2c_register_adapter(struct i2c_adapter *a= dap) return 0; =20 out_reg: + i2c_deregister_clients(adap); debugfs_remove_recursive(adap->debugfs); init_completion(&adap->dev_released); device_unregister(&adap->dev); @@ -1746,29 +1748,10 @@ static int __process_removed_adapter(struct device_= driver *d, void *data) return 0; } =20 -/** - * i2c_del_adapter - unregister I2C adapter - * @adap: the adapter being unregistered - * Context: can sleep - * - * This unregisters an I2C adapter which was previously registered - * by @i2c_add_adapter or @i2c_add_numbered_adapter. - */ -void i2c_del_adapter(struct i2c_adapter *adap) +static void i2c_deregister_clients(struct i2c_adapter *adap) { - struct i2c_adapter *found; struct i2c_client *client, *next; =20 - /* First make sure that this adapter was ever added */ - mutex_lock(&core_lock); - found =3D idr_find(&i2c_adapter_idr, adap->nr); - mutex_unlock(&core_lock); - if (found !=3D adap) { - pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name); - return; - } - - i2c_acpi_remove_space_handler(adap); /* Tell drivers about this removal */ mutex_lock(&core_lock); bus_for_each_drv(&i2c_bus_type, NULL, adap, @@ -1794,6 +1777,32 @@ void i2c_del_adapter(struct i2c_adapter *adap) * them up properly, so we give them a chance to do that first. */ device_for_each_child(&adap->dev, NULL, __unregister_client); device_for_each_child(&adap->dev, NULL, __unregister_dummy); +} + +/** + * i2c_del_adapter - unregister I2C adapter + * @adap: the adapter being unregistered + * Context: can sleep + * + * This unregisters an I2C adapter which was previously registered + * by @i2c_add_adapter or @i2c_add_numbered_adapter. + */ +void i2c_del_adapter(struct i2c_adapter *adap) +{ + struct i2c_adapter *found; + + /* First make sure that this adapter was ever added */ + mutex_lock(&core_lock); + found =3D idr_find(&i2c_adapter_idr, adap->nr); + mutex_unlock(&core_lock); + if (found !=3D adap) { + pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name); + return; + } + + i2c_acpi_remove_space_handler(adap); + + i2c_deregister_clients(adap); =20 /* device name is gone after device_unregister */ dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name); --=20 2.53.0 From nobody Sat Jun 13 01:41:35 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CA913FE67D; Mon, 11 May 2026 14:37:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; cv=none; b=nPMc38bzhrNCbljuNcewYDcrzjFjZjEErUhEeUDhlusfGIDHXl78FiI4NnkZI5B0WVlPr0KmyoPZgO8rywhWPieLALFqPBGY+RQ+nPR23mTFx72rtUO/6Js+h3vw5mn8JvbWOB172lXTaZXzbqhd4uNMaWFqR1lQn//Wtx7tymo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; c=relaxed/simple; bh=OjZv5/6+fk5Ts0lD7IC3u7oqHAa9DUHrxfnaatocV+s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bKg7aJLD6SaP3PbYDqDBsVliIEnJjpnVLFzbcScfVWiiEgmXUwnJCUSLd413mzDX280FDg4wdNUgpUsphNV7xM/2WCG5G/B1uIkznAiuId/+2Wbp99w0BYiVejLvxgf6PlJ8I7yy69UguR66HNExvXMTEoCYHuMzPkITLaNq6EE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Cj0wraeL; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Cj0wraeL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B208DC4AF0E; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=OjZv5/6+fk5Ts0lD7IC3u7oqHAa9DUHrxfnaatocV+s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Cj0wraeLLT4bHNE7cUnVjqdwhVNU0uKRzKruIaw68FCf+BnqA1Gisb89MwjgmxPXu yXT63CGLRG/UDA7GoRGAKjuY9VOTJpzM5/4UGmyr9PCznmr5WnjWIlT0Vv9hLLRNdk IXyXvhB2LSkQwnjilddHuns/DhQSLD3xwtrV02B7l+ZRzBUUgA18pM1Hch8jWKk4Nn RElMC25gXl46UQwpSRcGc2tSDt7f+1u4Tk+WF/ZK50a/jBz5J/2r/M8aisfhHHLNfb LnFkbGRX3FzUxn6MWLNluA3YIGweZNvyBNOt6xfePiJmLSrYGd+IN84nksg1HhDxRz 9x7Dd6c5TevwQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033qB-0jqv; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Joe Hattori Subject: [PATCH v3 03/10] i2c: core: fix NULL-deref on adapter registration failure Date: Mon, 11 May 2026 16:37:08 +0200 Message-ID: <20260511143715.729714-4-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If adapter registration ever fails the release callback would trigger a NULL-pointer dereference as the completion struct has not been initialised. Note that before the offending commit this would instead have resulted in a minor memory leak of the adapter name. Fixes: 3f8c4f5e9a57 ("i2c: core: fix reference leak in i2c_register_adapter= ()") Cc: stable@vger.kernel.org Cc: Joe Hattori Signed-off-by: Johan Hovold Reviewed-by: Wolfram Sang --- drivers/i2c/i2c-core-base.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index e42851a10098..fa9db415e219 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1574,8 +1574,7 @@ static int i2c_register_adapter(struct i2c_adapter *a= dap) res =3D device_add(&adap->dev); if (res) { pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); - put_device(&adap->dev); - goto err_remove_irq_domain; + goto err_put_adap; } =20 adap->debugfs =3D debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_ro= ot); @@ -1608,10 +1607,12 @@ static int i2c_register_adapter(struct i2c_adapter = *adap) out_reg: i2c_deregister_clients(adap); debugfs_remove_recursive(adap->debugfs); + device_del(&adap->dev); +err_put_adap: init_completion(&adap->dev_released); - device_unregister(&adap->dev); + put_device(&adap->dev); wait_for_completion(&adap->dev_released); -err_remove_irq_domain: + i2c_host_notify_irq_teardown(adap); out_list: mutex_lock(&core_lock); --=20 2.53.0 From nobody Sat Jun 13 01:41:35 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1C51F3FF884; Mon, 11 May 2026 14:37:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; cv=none; b=PXfdFwP8wZ4Dqc2w9pQ+xrFzIQ0aYECBw3MbyY701mSsrgli2Rfgk9WgHmGteCKCdQ5CaqYLejv5kFNlVw2J5Dm60fnzV/2/nG5jwh4xazZm3QBIyGOUk55lWSzk4V0AvP0RDJ5wTorR0/F4QqfWwIt8s3LBQF02GwU7/RFHpOc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; c=relaxed/simple; bh=7Ky3OZfr0RF6XOeZrPt3Y22wFgkR2InbGKSD9DORk+w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Zx9eLlOptGKiKD2HJmHuoB6FCO8438kW7uOeEwaPgz2XeWd/a4Ya8kGryl5isT5cAEvY22pj9Y478e8uMyXkM+HejQOoGDBHapBBhMSwwHT0wnWFqag81A48ZX/ihJJYOlqnDPeupLfz19TfyRU8PG5UbvPPFH1uy2Gth4qLRD0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=GRrVNVre; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="GRrVNVre" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E65FC2BCFB; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=7Ky3OZfr0RF6XOeZrPt3Y22wFgkR2InbGKSD9DORk+w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GRrVNVrePfjyL/Mlqyn9D74oriW+C8Tot6zVSy2QRwj6/7WD7LEM3nuoHVWtmqfAy GdgDCrLjkJPc6IIivSlZ9nIxD5qh7gJUfPdWnClDP6AWm+6g5kKZILLWiCkrRfMPVY +PKr/NUK248FZ2ZzIs0jIN4/9HWu0XobWr7qaqNV/Hi74KUumJsHlgJH7NxnuF09ar r9w6qOppcZmeaKxj28GH+5O/9KuZdiL1fI3JjlkXkHBhSeTxA+eRRnFenejGfkiBD7 m08tSd2ZnVmEaycGb0dnO6sRAgRfAOAvCMhKqRVWVmv8jd9+YU+6tK6aEwVpIXO+om ak2OeTD7Rjs/A== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033qD-0nht; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Codrin Ciubotariu Subject: [PATCH v3 04/10] i2c: core: fix adapter probe deferral loop Date: Mon, 11 May 2026 16:37:09 +0200 Message-ID: <20260511143715.729714-5-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Drivers must not probe defer after having registered devices as that will trigger a probe loop if the devices bind to a driver (cf. commit fbc35b45f9f6 ("Add documentation on meaning of -EPROBE_DEFER")). Move the recovery initialisation, where the GPIO lookup may fail, before registering the adapter to prevent this. Fixes: 75820314de26 ("i2c: core: add generic I2C GPIO recovery") Cc: stable@vger.kernel.org # 5.9 Cc: Codrin Ciubotariu Signed-off-by: Johan Hovold Reviewed-by: Wolfram Sang --- drivers/i2c/i2c-core-base.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index fa9db415e219..1caaa3b3ee10 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1562,6 +1562,10 @@ static int i2c_register_adapter(struct i2c_adapter *= adap) adap->dev.type =3D &i2c_adapter_type; device_initialize(&adap->dev); =20 + res =3D i2c_init_recovery(adap); + if (res =3D=3D -EPROBE_DEFER) + goto err_put_adap; + /* * This adapter can be used as a parent immediately after device_add(), * setup runtime-pm (especially ignore-children) before hand. @@ -1583,10 +1587,6 @@ static int i2c_register_adapter(struct i2c_adapter *= adap) if (res) goto out_reg; =20 - res =3D i2c_init_recovery(adap); - if (res =3D=3D -EPROBE_DEFER) - goto out_reg; - dev_dbg(&adap->dev, "adapter [%s] registered\n", adap->name); =20 /* create pre-declared device nodes */ --=20 2.53.0 From nobody Sat Jun 13 01:41:35 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D706C3FE37C; Mon, 11 May 2026 14:37:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510244; cv=none; b=eJGXj4ESDmWsG1/Tr3SmSzU8VX/yUMYGAZjw8A+FBJrODEpdhFPhSxmC596HpH4c/P8e6uNg4U/h4xt8T2G0oe7Z1sFJhKUA6BwTGYcmeCul31t3NA6Q/FjALY0Cm1S+BoFzqRRCg1Vxb3HyUk9vzGenVTXvRkggXyLUgZ0kpoM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510244; c=relaxed/simple; bh=BquGzohizkUxK6KJMBggUVDsdaucr4lh6uE74Vb78n8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qV4RFylqjlCfmyk47UvwygnT3sQSHFARZTeMvyeym0vx+qW0/CQ1TpCKa1+VAmfyGsafprdyxSY866pqHEyJ2KsT+XFRVAYogZhV1as3oHwfFVjJ98AkhxTWi90dPIp1//m83mykg1jrvnPoFQs9LnoWGW93iOAoHWQiFqkHWZE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=PMtiCCvG; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="PMtiCCvG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 922A0C4AF09; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=BquGzohizkUxK6KJMBggUVDsdaucr4lh6uE74Vb78n8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PMtiCCvGb3RaHpsKMkMtW40McZfBOzzqYABk6jiEnMGotBpzhGZMD1fODMAQrqSkE SbWdHBY7GFjdOxVvsyo4HKafKHve1priQVz0GspWeI2ozMq2CzXa4JstdtVYSiGcUg CW93OGsl/Q2ZUi5C1NrXAC8VFmYbPUFVIxNW4OyppXbbvB1jXsGBg13kCXa9q479Ma d+O0F/R1LUIOuq/VOtM9v7dVs4N7kWlgUZebgLtjacAQikOwkZSxbXmvCfhvZFtmyJ eolfMeDPB/ZHQrUSdIa5rk1rYJuXKk+M3witTxpbzuSMgzRSVDa4/1v+9o/22/Huu3 ZFR1IHJFHG6nw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033qF-0qt4; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH v3 05/10] i2c: core: fix adapter debugfs creation Date: Mon, 11 May 2026 16:37:10 +0200 Message-ID: <20260511143715.729714-6-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Clients can be registered from bus notifier callbacks so the debugfs directory needs to be created before registering the adapter as clients use that directory as their debugfs parent. Move debugfs creation before adapter registration to avoid having clients create their debugfs directories in the debugfs root (which is also more likely to fail due to name collisions). Note that failure to allocate the adapter name must now be handled explicitly as debugfs_create_dir() cannot handle a NULL name (unlike device_add() which returns an error). Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter") Cc: stable@vger.kernel.org # 6.8 Cc: Wolfram Sang Signed-off-by: Johan Hovold Reviewed-by: Wolfram Sang --- drivers/i2c/i2c-core-base.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 1caaa3b3ee10..25d66de41287 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1557,7 +1557,10 @@ static int i2c_register_adapter(struct i2c_adapter *= adap) goto out_list; } =20 - dev_set_name(&adap->dev, "i2c-%d", adap->nr); + res =3D dev_set_name(&adap->dev, "i2c-%d", adap->nr); + if (res) + goto err_remove_irq_domain; + adap->dev.bus =3D &i2c_bus_type; adap->dev.type =3D &i2c_adapter_type; device_initialize(&adap->dev); @@ -1575,14 +1578,14 @@ static int i2c_register_adapter(struct i2c_adapter = *adap) pm_suspend_ignore_children(&adap->dev, true); pm_runtime_enable(&adap->dev); =20 + adap->debugfs =3D debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_ro= ot); + res =3D device_add(&adap->dev); if (res) { pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); - goto err_put_adap; + goto err_remove_debugfs; } =20 - adap->debugfs =3D debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_ro= ot); - res =3D i2c_setup_smbus_alert(adap); if (res) goto out_reg; @@ -1606,13 +1609,14 @@ static int i2c_register_adapter(struct i2c_adapter = *adap) =20 out_reg: i2c_deregister_clients(adap); - debugfs_remove_recursive(adap->debugfs); device_del(&adap->dev); +err_remove_debugfs: + debugfs_remove_recursive(adap->debugfs); err_put_adap: init_completion(&adap->dev_released); put_device(&adap->dev); wait_for_completion(&adap->dev_released); - +err_remove_irq_domain: i2c_host_notify_irq_teardown(adap); out_list: mutex_lock(&core_lock); --=20 2.53.0 From nobody Sat Jun 13 01:41:35 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 259E23FF88D; Mon, 11 May 2026 14:37:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; cv=none; b=D8BKglDrcveD8gnfMSRkeVJGywbsXJ9OeSRqvLjnzxSF27T2MLdcOGI52+f/Coezkz3uwjctSl508s9rAimmOc4GMBpEn3oq7hvhLND/EQz6Pabpb1ynQytWphVKFTmDiSlhzHGbmRWzzjdxy5EOQtswyDkOwTCd2xOwDx1w1cU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; c=relaxed/simple; bh=30zEGKWoFiUVcuTx5dE6SloFHb/lSaCwgtqhVJSD8PI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bB4tW1dxPamWFiBUx5A/6rPL23GNJT+RpsQzjTFoTV8LatxwIQotx27rf7X3UR5iaH6AYC1tDV992mreFAvoleEqa4mcSKLsNj8R/Rer8AQjzTzdZgKVe3iJLKlR9cdpsmoPAv1dVm2Fn2uvewRjyM4D6kiOjB3Y0m4GvwkJqpM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=PAKzKpgy; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="PAKzKpgy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A51B7C2BCFF; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=30zEGKWoFiUVcuTx5dE6SloFHb/lSaCwgtqhVJSD8PI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PAKzKpgySeSaeZyLquywWpuUipfD38iTyv9CWEISBKysLPkCF6C1nh+M5C7Jfx6D/ 0apz6p8hQt7/xFqNZ+3EpXsw72sUdXAEK7vwjUnJ6UBe5Tsgie5qdFPpBsMewLYN2E fZ2bMkN+W3/VzqwfaLA2v4BS5pqrvzz7Jl3V/pYC48axdGdRumSIemqdcILkH0Smew lgW9AP2GQxrZKVMHuaWDWBtQTFYGvO9wbaJgbvXaIrbkfwKTdg4LfzY0OhlnS+6ZJ4 VqKSlG3tUxDnVjCG3mq9mUbMImADJyKzPuZLkYG036eXnO7658Qo2vz4JWDAsBBB9C R4pvGSC07BePg== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033qH-0uBO; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , Codrin Ciubotariu Subject: [PATCH v3 06/10] i2c: core: disable runtime PM on adapter registration failure Date: Mon, 11 May 2026 16:37:11 +0200 Message-ID: <20260511143715.729714-7-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Runtime PM is disabled by driver core when deregistering a device (and on registration failure) but add an explicit disable to balance the enable call when adapter registration fails for symmetry. Fixes: 23a698fe65ec ("i2c: core: treat EPROBE_DEFER when acquiring SCL/SDA = GPIOs") Cc: Codrin Ciubotariu Signed-off-by: Johan Hovold Reviewed-by: Wolfram Sang --- drivers/i2c/i2c-core-base.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 25d66de41287..fdf7d7d50f79 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1612,6 +1612,7 @@ static int i2c_register_adapter(struct i2c_adapter *a= dap) device_del(&adap->dev); err_remove_debugfs: debugfs_remove_recursive(adap->debugfs); + pm_runtime_disable(&adap->dev); err_put_adap: init_completion(&adap->dev_released); put_device(&adap->dev); --=20 2.53.0 From nobody Sat Jun 13 01:41:35 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0F6453FF881; Mon, 11 May 2026 14:37:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; cv=none; b=qTRRGLN+KfnxH8qtokhUjDOwLrOy7mNaP0q1iWsCoxhp8MIL9e49+JTJfemUmmHLt7wYqNsKFkKRG+QVw2fd1vxZZlF7A/JJlpg6+/U+Tfg+1bsd5dFHxCVXvzuMcGnwCaaBHozR0HKsdJq/uXf3aLqc2NQqHPc1YY+pv7ntQrY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510245; c=relaxed/simple; bh=OBF2OREyX/eQl2ehmRRJhV0SWGKPOfH3pmh0BnBUjsI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rKlQbo4t/J+Zda9TghEnln5jNH5D59je+l4x6hY27kpLMQ1ps3PcdfAkH22AKs6xD50ILycBOLxS3+nmVxtI2ClGXL5CP638mfq2OwTxIcRgHFJCRy2Twrbgawpx/q3yS5RfCgKEPBQcFPHv1ZRqlTcQfsHFyptq+2TZsOKb0+0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=QuA763UF; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="QuA763UF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 99B19C2BCFC; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=OBF2OREyX/eQl2ehmRRJhV0SWGKPOfH3pmh0BnBUjsI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QuA763UFw3iwmkZ2aanibldz5YO5SfM3iLhcy2sDp9tGPkt+oykWJ4JKyC3Yi2LUR Q+RoQBiMqjDwQCWvvK0ux6EuoVVn56RHfS9NKsXSG+JnoAfKQIYxUk6GOb3RWCfxVg 9w96VLLmSVkSWDDSBy2umc06Kal9uipofYx0iN7uYCoso/FM+ct2WjF09Fxe7u5OSj Z/IGqx+vLUGa43b7KJRpHlvaTzOdgsIB6d0kBZkuImFigThaZPhN6iY46wpcSaCaEy YYb1GlmKdnfyPucv4pT3f28VG9OXcNnFzzOMrqvRZOgV0zUIy9dBfjap1nfVBewleZ az9hycf8qtj4A== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033qJ-0xP7; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH v3 07/10] i2c: core: fix adapter registration race Date: Mon, 11 May 2026 16:37:12 +0200 Message-ID: <20260511143715.729714-8-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Adapters can be looked up based on their id using i2c_get_adapter() which takes a reference to the embedded struct device. Make sure that the adapter (including its struct device) has been initialised before adding it to the IDR to avoid accessing uninitialised data which could, for example, lead to NULL-pointer dereferences or use-after-free. Note that the i2c-dev chardev, which is registered from a bus notifier, currently uses i2c_get_adapter() so the adapter needs to be added to the IDR before registration. Fixes: 6e13e6418418 ("i2c: Add i2c_add_numbered_adapter()") Cc: stable@vger.kernel.org # 2.6.22 Signed-off-by: Johan Hovold Reviewed-by: Wolfram Sang --- drivers/i2c/i2c-core-base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index fdf7d7d50f79..01a984d3ca0e 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1580,6 +1580,10 @@ static int i2c_register_adapter(struct i2c_adapter *= adap) =20 adap->debugfs =3D debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_ro= ot); =20 + mutex_lock(&core_lock); + idr_replace(&i2c_adapter_idr, adap, adap->nr); + mutex_unlock(&core_lock); + res =3D device_add(&adap->dev); if (res) { pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); @@ -1638,7 +1642,7 @@ static int __i2c_add_numbered_adapter(struct i2c_adap= ter *adap) int id; =20 mutex_lock(&core_lock); - id =3D idr_alloc(&i2c_adapter_idr, adap, adap->nr, adap->nr + 1, GFP_KERN= EL); + id =3D idr_alloc(&i2c_adapter_idr, NULL, adap->nr, adap->nr + 1, GFP_KERN= EL); mutex_unlock(&core_lock); if (WARN(id < 0, "couldn't get idr")) return id =3D=3D -ENOSPC ? -EBUSY : id; @@ -1672,7 +1676,7 @@ int i2c_add_adapter(struct i2c_adapter *adapter) } =20 mutex_lock(&core_lock); - id =3D idr_alloc(&i2c_adapter_idr, adapter, + id =3D idr_alloc(&i2c_adapter_idr, NULL, __i2c_first_dynamic_bus_num, 0, GFP_KERNEL); mutex_unlock(&core_lock); if (WARN(id < 0, "couldn't get idr")) --=20 2.53.0 From nobody Sat Jun 13 01:41:35 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6E3F3FE373; Mon, 11 May 2026 14:37:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510244; cv=none; b=qgRF5rxRy9uXhBwEg0KsQxrfDPuAbu4SX1LE1ZKqZDsibRrg07O2cxsq7mvYGbZ93wQbcZlFhEdtaIBqXzGdoHUchwD8AuCyP6cPyIlx1Ld1QuXTwvSEENKLZ4JX4qlGrhgG3SQ8r3UroyOzH2R0PAk/UFMlaugraiYR0G0Msug= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510244; c=relaxed/simple; bh=oaJ1fIHI4x87EvSRfZxR+ViJYFD68Ek/0RZ9v3HJYrw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ShZQbMOTksH8PuwLqlCAgDV12sIHx0QIJsug3zph7nheIdf95qBAbmISFqTHHN8LK9AgHqR1XZmwP1gTfXm78ezUl4KP+0bzqD2SrnABba/aVzQ6DxP48ITuvKUMUBp985GpSKCcAgypLiVJeJqhFnRyGjivSsunrwowYEGpJKI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YtFfAwCu; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YtFfAwCu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9732FC2BCF7; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=oaJ1fIHI4x87EvSRfZxR+ViJYFD68Ek/0RZ9v3HJYrw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YtFfAwCubGBMWV36ZzHJPXjvK00xCSwlQsoD5hOUSz14PmhDGh4SD5+uMZ5wC+USv +Jg/No9SEw5/KpD3L03+LQlsPKlPDyCAXs2U2IACxiMsrZTs9XjF3PMMN5pYFvRwHG PwU5eRPw4XCpHtUij1hB3UTi+4cVbaRFzVwJ1uK3fFcvE9LVumrNMdo3LV0KCuwoAh k8K+m2ljip5RJnSQ/279J6mg7V5l5yy90aLWwjxZbtCzOrfUGOL1wob6Xko6VXs5cP Z6Mj0nFT4MdPZovMW1PFEGLrp03vEmCXZD63Fei1+ZHF02kCKqBsD2Yt7ZORqfWj7q bY9G0euTToX/g== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033qL-10gS; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Jean Delvare Subject: [PATCH v3 08/10] i2c: core: fix adapter deregistration race Date: Mon, 11 May 2026 16:37:13 +0200 Message-ID: <20260511143715.729714-9-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during deregistration (and on registration failure) to make sure its resources are not accessed after having been freed (e.g. the device name). Fixes: 35fc37f81881 ("i2c: Limit core locking to the necessary sections") Cc: stable@vger.kernel.org # 2.6.31 Cc: Jean Delvare Signed-off-by: Johan Hovold Reviewed-by: Wolfram Sang --- drivers/i2c/i2c-core-base.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 01a984d3ca0e..38f425aecef8 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1587,7 +1587,7 @@ static int i2c_register_adapter(struct i2c_adapter *a= dap) res =3D device_add(&adap->dev); if (res) { pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); - goto err_remove_debugfs; + goto err_replace_id; } =20 res =3D i2c_setup_smbus_alert(adap); @@ -1614,7 +1614,10 @@ static int i2c_register_adapter(struct i2c_adapter *= adap) out_reg: i2c_deregister_clients(adap); device_del(&adap->dev); -err_remove_debugfs: +err_replace_id: + mutex_lock(&core_lock); + idr_replace(&i2c_adapter_idr, NULL, adap->nr); + mutex_unlock(&core_lock); debugfs_remove_recursive(adap->debugfs); pm_runtime_disable(&adap->dev); err_put_adap: @@ -1804,6 +1807,8 @@ void i2c_del_adapter(struct i2c_adapter *adap) /* First make sure that this adapter was ever added */ mutex_lock(&core_lock); found =3D idr_find(&i2c_adapter_idr, adap->nr); + if (found =3D=3D adap) + idr_replace(&i2c_adapter_idr, NULL, adap->nr); mutex_unlock(&core_lock); if (found !=3D adap) { pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name); --=20 2.53.0 From nobody Sat Jun 13 01:41:35 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6EFE3FE374; Mon, 11 May 2026 14:37:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510244; cv=none; b=Jce8x2iKFVAWjYLwiF2KlYP8e61EQWhUI+1iCk63EDgfI2s1Z6aZyaeSQENL3Yqwy/T16qu0e4zNdntBJC72dq96OINHxryFJ0rgruvmKZYQ7foSTC3qMCi0x1XmBgutlTvLm/s2EP+RWC5vYW+ioez9BzGN2749J8KL13fY1JM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510244; c=relaxed/simple; bh=eihvSdYvDEAsiJ1gC2UmX+JrpysYRhv4c4ZhELH2oFE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oCSFi2ePQaRnvlZAYfZBCzJpcj0w+TourAzSJJp6Ia10bxCMlbsMksLuAui7wONYmd5dyHgD/+6FgAXV5xlDYzOTjLvmnMYLxiDDy4p8f1PQTrVz6u+ipeCScu7hWoTiMqOVX3Fv4PwIjCACuswH2Y4AcI/uqZ780FxSkBvpN5w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DyFxaBQQ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DyFxaBQQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8DDEFC2BCB0; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=eihvSdYvDEAsiJ1gC2UmX+JrpysYRhv4c4ZhELH2oFE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DyFxaBQQ5zsgZLcSdXevXVELWJZPDA4A62EFrf3G7Qm/t3icPpXHcuGM4m5WHmlN4 ZAStR07MncXtv9e9pCAIwQ1MIk+6ltJSQjGGHD9QAuCktNuCBZsb8SzYHr4fw/4nmx x5ndwSXHE/nUAmqbXV90e0rGsaydVJMyC3ISY0k1fi3BO4rN7kJwBO59KiHoDc1Grn ygQHwjywkTGMhtOpvdMm/vzr7MIE6x1AA02KUuTm/c75Or0QuhgPnM39fgNNI31Jzk +/coZMeZ9zCqqhGxjvGJcuvQeey41hKfgnT/FRMQNAADXJYW3oRu7aynWGiH8AaZ7J 327/N5aiBUgwQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033qN-14K4; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH v3 09/10] i2c: core: clean up bus id allocation Date: Mon, 11 May 2026 16:37:14 +0200 Message-ID: <20260511143715.729714-10-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Clean up bus id allocation by using a common helper and deferring it until it is needed during adapter registration. Signed-off-by: Johan Hovold Reviewed-by: Wolfram Sang --- drivers/i2c/i2c-core-base.c | 89 +++++++++++++++++++------------------ 1 file changed, 45 insertions(+), 44 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 38f425aecef8..2cd384433d83 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1517,23 +1517,48 @@ int i2c_handle_smbus_host_notify(struct i2c_adapter= *adap, unsigned short addr) } EXPORT_SYMBOL_GPL(i2c_handle_smbus_host_notify); =20 +static int i2c_allocate_adapter_id(struct i2c_adapter *adap) +{ + int id, start, end; + + if (adap->nr =3D=3D -1) { + start =3D __i2c_first_dynamic_bus_num; + end =3D 0; + } else { + start =3D adap->nr; + end =3D adap->nr + 1; + } + + mutex_lock(&core_lock); + id =3D idr_alloc(&i2c_adapter_idr, NULL, start, end, GFP_KERNEL); + mutex_unlock(&core_lock); + if (id < 0) { + if (adap->nr !=3D -1 && id =3D=3D -ENOSPC) + id =3D -EBUSY; + pr_err("adapter '%s': failed to allocate id: %d\n", adap->name, id); + return id; + } + + adap->nr =3D id; + + return 0; +} + static int i2c_register_adapter(struct i2c_adapter *adap) { - int res =3D -EINVAL; + int res; =20 /* Can't register until after driver model init */ - if (WARN_ON(!is_registered)) { - res =3D -EAGAIN; - goto out_list; - } + if (WARN_ON(!is_registered)) + return -EAGAIN; =20 /* Sanity checks */ if (WARN(!adap->name[0], "i2c adapter has no name")) - goto out_list; + return -EINVAL; =20 if (!adap->algo) { pr_err("adapter '%s': no algo supplied!\n", adap->name); - goto out_list; + return -EINVAL; } =20 if (!adap->lock_ops) @@ -1554,13 +1579,17 @@ static int i2c_register_adapter(struct i2c_adapter = *adap) if (res) { pr_err("adapter '%s': can't create Host Notify IRQs (%d)\n", adap->name, res); - goto out_list; + return res; } =20 - res =3D dev_set_name(&adap->dev, "i2c-%d", adap->nr); + res =3D i2c_allocate_adapter_id(adap); if (res) goto err_remove_irq_domain; =20 + res =3D dev_set_name(&adap->dev, "i2c-%d", adap->nr); + if (res) + goto err_free_id; + adap->dev.bus =3D &i2c_bus_type; adap->dev.type =3D &i2c_adapter_type; device_initialize(&adap->dev); @@ -1624,33 +1653,14 @@ static int i2c_register_adapter(struct i2c_adapter = *adap) init_completion(&adap->dev_released); put_device(&adap->dev); wait_for_completion(&adap->dev_released); -err_remove_irq_domain: - i2c_host_notify_irq_teardown(adap); -out_list: +err_free_id: mutex_lock(&core_lock); idr_remove(&i2c_adapter_idr, adap->nr); mutex_unlock(&core_lock); - return res; -} - -/** - * __i2c_add_numbered_adapter - i2c_add_numbered_adapter where nr is never= -1 - * @adap: the adapter to register (with adap->nr initialized) - * Context: can sleep - * - * See i2c_add_numbered_adapter() for details. - */ -static int __i2c_add_numbered_adapter(struct i2c_adapter *adap) -{ - int id; - - mutex_lock(&core_lock); - id =3D idr_alloc(&i2c_adapter_idr, NULL, adap->nr, adap->nr + 1, GFP_KERN= EL); - mutex_unlock(&core_lock); - if (WARN(id < 0, "couldn't get idr")) - return id =3D=3D -ENOSPC ? -EBUSY : id; +err_remove_irq_domain: + i2c_host_notify_irq_teardown(adap); =20 - return i2c_register_adapter(adap); + return res; } =20 /** @@ -1673,17 +1683,8 @@ int i2c_add_adapter(struct i2c_adapter *adapter) int id; =20 id =3D of_alias_get_id(dev->of_node, "i2c"); - if (id >=3D 0) { - adapter->nr =3D id; - return __i2c_add_numbered_adapter(adapter); - } - - mutex_lock(&core_lock); - id =3D idr_alloc(&i2c_adapter_idr, NULL, - __i2c_first_dynamic_bus_num, 0, GFP_KERNEL); - mutex_unlock(&core_lock); - if (WARN(id < 0, "couldn't get idr")) - return id; + if (id < 0) + id =3D -1; =20 adapter->nr =3D id; =20 @@ -1719,7 +1720,7 @@ int i2c_add_numbered_adapter(struct i2c_adapter *adap) if (adap->nr =3D=3D -1) /* -1 means dynamically assign bus id */ return i2c_add_adapter(adap); =20 - return __i2c_add_numbered_adapter(adap); + return i2c_register_adapter(adap); } EXPORT_SYMBOL_GPL(i2c_add_numbered_adapter); =20 --=20 2.53.0 From nobody Sat Jun 13 01:41:35 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6F9B3FE37B; Mon, 11 May 2026 14:37:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510244; cv=none; b=mdtjNsGbsQK0J+YiL9fDflYjz1zBGN6TDEitWHc0IdCWFvVKxUNivnFILDnTtj9SHuyhqIHXTJZi1hosYRlvAyhCqGYzLDNa+JFA1oMxOjfy00Ee6nsR8UmGJ8rLagEi1HTMtqK0i+Vu1gpcz4sRVm4PPrCXZYlXR5Gl63wx/OA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778510244; c=relaxed/simple; bh=b94tPEnD6maJKXICVqXB7tFOvSmpC6EOT8BuhpCgtgE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DGgBfUkyONIRRQgVykIy1/eM5XFrueRflz1+wSX+rdEPsCdpLuP6tJoOe780YfJ0Qhg/JvoWUJF3ndxxsC2os+Hw2rprgLiZCflL85+lFUri95xKnZupD+94UxvL3a27D1dOekCWyysy5l3v06LP54EIrPn0dBNs2PdNgiJyFu8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fdJRGHpy; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fdJRGHpy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 94831C2BCFA; Mon, 11 May 2026 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778510244; bh=b94tPEnD6maJKXICVqXB7tFOvSmpC6EOT8BuhpCgtgE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fdJRGHpylu0t2fSVXW9buUFmD6IDAUh6Cuk5eEafpil1GejTRk0LKtUYbr3PthSgC B2q4PHB2QGAvhl5GUipAjT4Qp29xD/u7gPaxBdVLKSEWncFaQabk28nlu1VlfFJsxB cP2N6+d7nkafCKIRKoIseFOL/hRw4LHgiFcJSzsMSV1QMji9eCOybmglEBAabszVn9 1/jjvbt3VIcp/tguT47ZYA0pZeOG9PgwgOKmxxoVwoCzaq/bx+83+yj/O1+6pcmz/p l/gKw5C7LGXI5ELovyCzefdzdzs4oB6AcqqGXa7tgvjeBFiDp0yyerQ8TZBNE5nwuR 7x9NV6LTmhYIw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wMRl4-000000033qP-17a1; Mon, 11 May 2026 16:37:22 +0200 From: Johan Hovold To: Wolfram Sang Cc: Andi Shyti , linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH v3 10/10] i2c: core: clean up adapter registration error label Date: Mon, 11 May 2026 16:37:15 +0200 Message-ID: <20260511143715.729714-11-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260511143715.729714-1-johan@kernel.org> References: <20260511143715.729714-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Clean up the adapter registration error labels by making sure that also the last one is named after what it does. Signed-off-by: Johan Hovold Reviewed-by: Wolfram Sang --- drivers/i2c/i2c-core-base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 2cd384433d83..5ddd985dfccb 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1621,7 +1621,7 @@ static int i2c_register_adapter(struct i2c_adapter *a= dap) =20 res =3D i2c_setup_smbus_alert(adap); if (res) - goto out_reg; + goto err_deregister_clients; =20 dev_dbg(&adap->dev, "adapter [%s] registered\n", adap->name); =20 @@ -1640,7 +1640,7 @@ static int i2c_register_adapter(struct i2c_adapter *a= dap) =20 return 0; =20 -out_reg: +err_deregister_clients: i2c_deregister_clients(adap); device_del(&adap->dev); err_replace_id: --=20 2.53.0