intel / intel/ipu6-drivers

I2c_adapter was grabed and never freed

Open
#304 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
251
Forks
75
PR merge metrics
No merged PRs in 30d

Description

There are two while loops in this function try to grab and check i2c_adapter. But after check, the i2c_adapter was not put by i2c_put_adapter, so the irrevalent i2c_adapter refcount will be up and never down.

We found this bug in i915 driver unload, since the DP i2c adapter cannot be released ...

int ipu_get_i2c_bus_id(int adapter_id, char *adapter_bdf, int bdf_len)
{
struct i2c_adapter *adapter;
char name[32];
int i = 0;

if (adapter_bdf) {
while ((adapter = i2c_get_adapter(i)) != NULL) {
struct device *parent = adapter->dev.parent;
struct device *pp = parent->parent;

if (pp && !strncmp(adapter_bdf, dev_name(pp), bdf_len))
return i;
i++;
}
}

i = 0;
snprintf(name, sizeof(name), "i2c_designware.%d", adapter_id);
while ((adapter = i2c_get_adapter(i)) != NULL) {
struct device *parent = adapter->dev.parent;

if (parent && !strncmp(name, dev_name(parent), sizeof(name)))
return i;
i++;
}

/* Not found, should never happen! */
WARN_ON_ONCE(1);
return -1;
}
EXPORT_SYMBOL_GPL(ipu_get_i2c_bus_id);

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.