[PATCH] drm/xe/i2c: cancel the client work on remove

[PATCH] drm/xe/i2c: cancel the client work on remove

[Fan Wu]

xe_i2c_notifier() stores the DesignWare adapter in i2c->adapter and
schedules i2c->work when the adapter is registered under the xe I2C
platform device, and xe_i2c_client_work() then instantiates the AMC
client device on that adapter.

xe_i2c_remove() unregisters the client devices, the bus notifier and
the adapter platform device, but it never drains i2c->work. A work
item that is still queued or running when the adapter is unregistered
dereferences i2c->adapter in i2c_new_client_device() after
platform_device_unregister() has released the adapter. The work item
is also embedded in the devm-allocated struct xe_i2c, so a work item
still queued after the drm device devm unwind frees that allocation
runs its callback on freed memory.

Cancel the work in xe_i2c_remove(), after bus_unregister_notifier()
so that no new instance can be scheduled, and before the adapter is
unregistered so that a running instance still finds a live adapter.

This issue was found by an in-house static analysis tool.

Fixes: f0e53aadd702 ("drm/xe: Support for I2C attached MCUs")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/gpu/drm/xe/xe_i2c.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/xe/xe_i2c.c b/drivers/gpu/drm/xe/xe_i2c.c
index 706783863d07..5a176d78193b 100644
--- a/drivers/gpu/drm/xe/xe_i2c.c
+++ b/drivers/gpu/drm/xe/xe_i2c.c
@@ -311,6 +311,7 @@ static void xe_i2c_remove(void *data)
 		i2c_unregister_device(i2c->client[i]);
 
 	bus_unregister_notifier(&i2c_bus_type, &i2c->bus_notifier);
+	cancel_work_sync(&i2c->work);
 	xe_i2c_unregister_adapter(i2c);
 	xe_i2c_remove_irq(i2c);
 }

Re: [PATCH] drm/xe/i2c: cancel the client work on remove

[Rodrigo Vivi]

On Wed, Sep 09, 2026 at 05:23:28AM +0000, Fan Wu wrote:
> xe_i2c_notifier() stores the DesignWare adapter in i2c->adapter and
> schedules i2c->work when the adapter is registered under the xe I2C
> platform device, and xe_i2c_client_work() then instantiates the AMC
> client device on that adapter.
> 
> xe_i2c_remove() unregisters the client devices, the bus notifier and
> the adapter platform device, but it never drains i2c->work. A work
> item that is still queued or running when the adapter is unregistered
> dereferences i2c->adapter in i2c_new_client_device() after
> platform_device_unregister() has released the adapter. The work item
> is also embedded in the devm-allocated struct xe_i2c, so a work item
> still queued after the drm device devm unwind frees that allocation
> runs its callback on freed memory.
> 
> Cancel the work in xe_i2c_remove(), after bus_unregister_notifier()
> so that no new instance can be scheduled, and before the adapter is
> unregistered so that a running instance still finds a live adapter.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: f0e53aadd702 ("drm/xe: Support for I2C attached MCUs")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Co-developed-by: Song Li <songl@zju.edu.cn>
> Signed-off-by: Song Li <songl@zju.edu.cn>
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
> ---
>  drivers/gpu/drm/xe/xe_i2c.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_i2c.c b/drivers/gpu/drm/xe/xe_i2c.c
> index 706783863d07..5a176d78193b 100644
> --- a/drivers/gpu/drm/xe/xe_i2c.c
> +++ b/drivers/gpu/drm/xe/xe_i2c.c
> @@ -311,6 +311,7 @@ static void xe_i2c_remove(void *data)
>  		i2c_unregister_device(i2c->client[i]);
>  
>  	bus_unregister_notifier(&i2c_bus_type, &i2c->bus_notifier);
> +	cancel_work_sync(&i2c->work);
>  	xe_i2c_unregister_adapter(i2c);
>  	xe_i2c_remove_irq(i2c);

This code has changed. Could you please rebase on top of drm-tip?

Then recheck your solution. You might need something different...

>  }
>