I2c_adapter was grabed and never freed
- Dominant language
- C
- Stars
- 251
- Forks
- 75
- PR merge metrics
- No merged PRs in 30d
Description
There are two while loops in this function try to grab and check i2c_adapter. But after check, the i2c_adapter was not put by i2c_put_adapter, so the irrevalent i2c_adapter refcount will be up and never down.
We found this bug in i915 driver unload, since the DP i2c adapter cannot be released ...
int ipu_get_i2c_bus_id(int adapter_id, char *adapter_bdf, int bdf_len)
{
struct i2c_adapter *adapter;
char name[32];
int i = 0;
if (adapter_bdf) {
while ((adapter = i2c_get_adapter(i)) != NULL) {
struct device *parent = adapter->dev.parent;
struct device *pp = parent->parent;
if (pp && !strncmp(adapter_bdf, dev_name(pp), bdf_len))
return i;
i++;
}
}
i = 0;
snprintf(name, sizeof(name), "i2c_designware.%d", adapter_id);
while ((adapter = i2c_get_adapter(i)) != NULL) {
struct device *parent = adapter->dev.parent;
if (parent && !strncmp(name, dev_name(parent), sizeof(name)))
return i;
i++;
}
/* Not found, should never happen! */
WARN_ON_ONCE(1);
return -1;
}
EXPORT_SYMBOL_GPL(ipu_get_i2c_bus_id);
Contributor guide
Assessment
This issue has not been assessed yet.