i2c_atr_add_adapter() stores atr->adapter[chan_id] before
i2c_add_adapter() so that the I2C bus notifier can match child clients
during registration. On failure the channel is freed but the slot was
left pointing at freed memory, which can lead to use-after-free in
i2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST.

Clear the slot on the i2c_add_adapter() error path before freeing chan.

Fixes: a076a860acae ("media: i2c: add I2C Address Translator (ATR) support")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
 drivers/i2c/i2c-atr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/i2c-atr.c b/drivers/i2c/i2c-atr.c
index e6d2af659d81..729d6d88a39d 100644
--- a/drivers/i2c/i2c-atr.c
+++ b/drivers/i2c/i2c-atr.c
@@ -857,6 +857,7 @@ int i2c_atr_add_adapter(struct i2c_atr *atr, struct i2c_atr_adap_desc *desc)
 	if (ret) {
 		dev_err(dev, "failed to add atr-adapter %u (error=%d)\n",
 			chan_id, ret);
+		atr->adapter[chan_id] = NULL;
 		goto err_free_alias_pool;
 	}
 
-- 
2.25.1

On Thu, Aug 06, 2026 at 03:35:45PM +0800, Linkai Gong wrote:
> i2c_atr_add_adapter() stores atr->adapter[chan_id] before
> i2c_add_adapter() so that the I2C bus notifier can match child clients
> during registration. On failure the channel is freed but the slot was
> left pointing at freed memory, which can lead to use-after-free in
> i2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST.
> 
> Clear the slot on the i2c_add_adapter() error path before freeing chan.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

...

>  	if (ret) {
>  		dev_err(dev, "failed to add atr-adapter %u (error=%d)\n",
>  			chan_id, ret);
> +		atr->adapter[chan_id] = NULL;

It's better to NULLify first and print after. This will reduce the window of
possible calls with the stale pointer.

>  		goto err_free_alias_pool;
>  	}

-- 
With Best Regards,
Andy Shevchenko

On Tue, Aug 11, 2026 at 05:36:13PM +0300, Andy Shevchenko wrote:
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
>
> ...
>
> >  	if (ret) {
> >  		dev_err(dev, "failed to add atr-adapter %u (error=%d)\n",
> >  			chan_id, ret);
> > +		atr->adapter[chan_id] = NULL;
>
> It's better to NULLify first and print after. This will reduce the window of
> possible calls with the stale pointer.

Agreed. I will send a v2 that clears the slot before the error print.

Thanks,
Linkai

i2c_atr_add_adapter() stores atr->adapter[chan_id] before
i2c_add_adapter() so that the I2C bus notifier can match child clients
during registration. On failure the channel is freed but the slot was
left pointing at freed memory, which can lead to use-after-free in
i2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST.

Clear the slot on the i2c_add_adapter() error path before freeing chan.

Fixes: a076a860acae ("media: i2c: add I2C Address Translator (ATR) support")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
v2:
- NULL the slot before the error print (Andy)

 drivers/i2c/i2c-atr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/i2c-atr.c b/drivers/i2c/i2c-atr.c
index e6d2af659d81..ca29633dcd62 100644
--- a/drivers/i2c/i2c-atr.c
+++ b/drivers/i2c/i2c-atr.c
@@ -855,6 +855,7 @@ int i2c_atr_add_adapter(struct i2c_atr *atr, struct i2c_atr_adap_desc *desc)
 
 	ret = i2c_add_adapter(&chan->adap);
 	if (ret) {
+		atr->adapter[chan_id] = NULL;
 		dev_err(dev, "failed to add atr-adapter %u (error=%d)\n",
 			chan_id, ret);
 		goto err_free_alias_pool;
-- 
2.25.1

Hi Linkai,

On Mon, Sep 07, 2026 at 03:11:02PM +0800, Linkai Gong wrote:
> i2c_atr_add_adapter() stores atr->adapter[chan_id] before
> i2c_add_adapter() so that the I2C bus notifier can match child clients
> during registration. On failure the channel is freed but the slot was
> left pointing at freed memory, which can lead to use-after-free in
> i2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST.
> 
> Clear the slot on the i2c_add_adapter() error path before freeing chan.
> 
> Fixes: a076a860acae ("media: i2c: add I2C Address Translator (ATR) support")
> Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

pushed to i2c/i2c-fixes.

Please, next time don't send v2 as --in-reply-to.

Thank you,
Andi