xe_i2c_notifier() stores the DesignWare adapter in i2c->adapter and
schedules i2c->work when the adapter is registered under the xe I2C
platform device, and xe_i2c_client_work() then instantiates the AMC
client device on that adapter.
xe_i2c_remove() tears down the AMC, unregisters the client devices,
the bus notifier and the adapter platform device, but it never drains
i2c->work. A work item that is still queued or running when the
adapter is unregistered dereferences i2c->adapter in
i2c_new_client_device() after platform_device_unregister() has
released the adapter. The work item is also embedded in the
devm-allocated struct xe_i2c, so a work item still queued after the
drm device devm unwind frees that allocation runs its callback on
freed memory.
Cancel the work in xe_i2c_remove(), after bus_unregister_notifier()
so that no new instance can be scheduled, and before the adapter is
unregistered so that a running instance still finds a live adapter.
This issue was found by an in-house static analysis tool.
Fixes: f0e53aadd702 ("drm/xe: Support for I2C attached MCUs")
Cc: [email protected]
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <[email protected]>
Signed-off-by: Song Li <[email protected]>
Signed-off-by: Fan Wu <[email protected]>
---
Changes in v2:
- Rebase onto drm-xe-next as requested. xe_i2c_remove() now calls
xe_amc_exit() first and no longer tears down an irqdomain. The bus
notifier still needs to be unregistered before draining i2c->work,
so keep cancel_work_sync() at that point. (Rodrigo Vivi)
Link: https://lore.kernel.org/r/[email protected]
drivers/gpu/drm/xe/xe_i2c.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/xe/xe_i2c.c b/drivers/gpu/drm/xe/xe_i2c.c
index d8fa68206f41..143ca7145e4f 100644
--- a/drivers/gpu/drm/xe/xe_i2c.c
+++ b/drivers/gpu/drm/xe/xe_i2c.c
@@ -334,6 +334,7 @@ static void xe_i2c_remove(void *data)
}
bus_unregister_notifier(&i2c_bus_type, &i2c->bus_notifier);
+ cancel_work_sync(&i2c->work);
xe_i2c_unregister_adapter(i2c);
}
