drm/mediatek: mtk_hdmi_common: take i2c adapter module reference
Subsystems (3)
PATCH 1/1 drm/mediatek: mtk_hdmi_common: take i2c adapter module reference
The i2c subsystem currently blocks during adapter deregistration whenever there are consumers holding a reference.
Switch to using of_get_i2c_adapter_by_node() which also takes a reference to the adapter module so that an attempt to unload the module while in use fails gracefully instead of blocking uninterruptibly.
--- drivers/gpu/drm/mediatek/mtk_hdmi_common.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi_common.c +9 -2
@@ -290,6 +290,13 @@ static int mtk_hdmi_get_cec_dev(struct mtk_hdmi *hdmi, struct device *dev, strucreturn 0 ; } +static void mtk_hdmi_put_adapter (void *_adap) +{ +struct i2c_adapter *adap = _adap; + +i2c_put_adapter (adap); +} +static int mtk_hdmi_dt_parse_pdata (struct mtk_hdmi *hdmi,struct platform_device *pdev,const char *const *clk_names,size_t num_clocks) {
@@ -328,12 +335,12 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, struct platform_deviceif (!i2c_np)return dev_err_probe (dev, -EINVAL ,"No ddc-i2c-bus in connector\n" ); - hdmi->ddc_adpt =of_find_i2c_adapter_by_node (i2c_np); + hdmi->ddc_adpt =of_get_i2c_adapter_by_node (i2c_np);of_node_put (i2c_np);if (!hdmi->ddc_adpt)return dev_err_probe (dev, -EPROBE_DEFER ,"Failed to get ddc i2c adapter by node\n" ); - ret =devm_add_action_or_reset (dev, mtk_hdmi_put_device, &hdmi->ddc_adpt->dev); + ret =devm_add_action_or_reset (dev, mtk_hdmi_put_adapter, hdmi->ddc_adpt);if (ret)return ret;
Signature · 1 line
2.54.0
[email protected]
AI reviewThank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] Double-free of I2C adapter device and module references during driver unbind due to conflicting manual and devm cleanups. --
--- Patch [1]: [PATCH] drm/mediatek: mtk_hdmi_common: take i2c adapter module reference --- commit cbad79e276722919c8f55731b14f0b51837c5548
Author: Johan Hovold <[email protected]>
drm/mediatek: mtk_hdmi_common: take i2c adapter module reference
The patch switches to of_get_i2c_adapter_by_node() which grabs a module reference, allowing graceful module unload failures instead of uninterruptible blocking. It updates the devm action to call mtk_hdmi_put_adapter which wraps i2c_put_adapter.
Quoted 4 lines
drivers/gpu/drm/mediatek/mtk_hdmi_common.c +0
-0
[ ... ]
drivers/gpu/drm/mediatek/mtk_hdmi_common.c static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, struct platform_device · line 343
Quoted 12 lines
drivers/gpu/drm/mediatek/mtk_hdmi_common.c +2
-2@@ -328,12 +335,12 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, struct platform_deviceif (!i2c_np)return dev_err_probe (dev, -EINVAL ,"No ddc-i2c-bus in connector\n" ); - hdmi->ddc_adpt =of_find_i2c_adapter_by_node (i2c_np); + hdmi->ddc_adpt =of_get_i2c_adapter_by_node (i2c_np);of_node_put (i2c_np);if (!hdmi->ddc_adpt)return dev_err_probe (dev, -EPROBE_DEFER ,"Failed to get ddc i2c adapter by node\n" ); - ret =devm_add_action_or_reset (dev, mtk_hdmi_put_device, &hdmi->ddc_adpt->dev); + ret =devm_add_action_or_reset (dev, mtk_hdmi_put_adapter, hdmi->ddc_adpt);
[Severity: High]
This is a pre-existing issue, but does this devm cleanup conflict with a manual cleanup during driver unbind?
Looking at mtk_hdmi_v2_remove() in drivers/gpu/drm/mediatek/mtk_hdmi_v2.c, there is a manual call to i2c_put_adapter(hdmi->ddc_adpt).
When the driver unbinds, mtk_hdmi_v2_remove() will run and release the adapter. After the remove callback returns, the device core will execute the devres action registered here. This will invoke mtk_hdmi_put_adapter() and call i2c_put_adapter() a second time on the same pointer.
Will this result in a double-free of the I2C adapter device and a double module_put()?
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
Quoted 6 lines · Johan Hovold
The i2c subsystem currently blocks during adapter deregistration whenever there are consumers holding a reference.
Switch to using
of_get_i2c_adapter_by_node()which also takes a reference to the adapter module so that an attempt to unload the module while in use fails gracefully instead of blocking uninterruptibly.
Quoted 39 lines
Signed-off-by Johan Hovold <[email protected]>--- drivers/gpu/drm/mediatek/mtk_hdmi_common.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)drivers/gpu/drm/mediatek/mtk_hdmi_common.c +9
-2@@ -290,6 +290,13 @@ static int mtk_hdmi_get_cec_dev(struct mtk_hdmi *hdmi, struct device *dev, strucreturn 0 ; } +static void mtk_hdmi_put_adapter (void *_adap) +{ +struct i2c_adapter *adap = _adap; + +i2c_put_adapter (adap); +} +static int mtk_hdmi_dt_parse_pdata (struct mtk_hdmi *hdmi,struct platform_device *pdev,const char *const *clk_names,size_t num_clocks) {@@ -328,12 +335,12 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, struct platform_deviceif (!i2c_np)return dev_err_probe (dev, -EINVAL ,"No ddc-i2c-bus in connector\n" ); - hdmi->ddc_adpt =of_find_i2c_adapter_by_node (i2c_np); + hdmi->ddc_adpt =of_get_i2c_adapter_by_node (i2c_np);of_node_put (i2c_np);if (!hdmi->ddc_adpt)return dev_err_probe (dev, -EPROBE_DEFER ,"Failed to get ddc i2c adapter by node\n" ); - ret =devm_add_action_or_reset (dev, mtk_hdmi_put_device, &hdmi->ddc_adpt->dev); + ret =devm_add_action_or_reset (dev, mtk_hdmi_put_adapter, hdmi->ddc_adpt);if (ret)return ret;
Johan Hovold <[email protected]> 於 2026年7月16日週四 下午1:21寫道：
Quoted 7 lines
The i2c subsystem currently blocks during adapter deregistration whenever there are consumers holding a reference.
Switch to using
of_get_i2c_adapter_by_node()which also takes a reference to the adapter module so that an attempt to unload the module while in use fails gracefully instead of blocking uninterruptibly.
Applied to mediatek-drm-fixes [1], thanks.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux.git/log/?h=mediatek-drm-fixes
Regards,
Chun-Kuang.
Quoted 3 lines
Signed-off-by Johan Hovold <[email protected]>---