[PATCH] i2c: atr: fix race condition caused by static local variable in i2c_atr_map_msgs()

[PATCH] i2c: atr: fix race condition caused by static local variable in i2c_atr_map_msgs()

[zhangjiao2]

From: zhang jiao <zhangjiao2@cmss.chinamobile.com>

The variable `c2a` in i2c_atr_map_msgs() is declared `static`, which means
it is shared across all invocations of this function regardless of which
ATR channel is being serviced. Since each channel has its own
orig_addrs_lock and alias_pairs_lock mutexes, two threads can execute
i2c_atr_map_msgs() concurrently on different channels, racing on the
shared `c2a` pointer.

This can cause:
- The wrong alias to be used for address translation, sending I2C
  transactions to the wrong device.
- The `fixed` flag of an unrelated mapping to be corrupted, breaking the
  alias replacement logic.

Remove the `static` keyword so that `c2a` becomes a regular local
variable, eliminating the shared state between concurrent calls.

Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
---
 drivers/i2c/i2c-atr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-atr.c b/drivers/i2c/i2c-atr.c
index e6d2af659d81..c9ad46db438d 100644
--- a/drivers/i2c/i2c-atr.c
+++ b/drivers/i2c/i2c-atr.c
@@ -360,7 +360,7 @@ static int i2c_atr_map_msgs(struct i2c_atr_chan *chan, struct i2c_msg *msgs,
 			    int num)
 {
 	struct i2c_atr *atr = chan->atr;
-	static struct i2c_atr_alias_pair *c2a;
+	struct i2c_atr_alias_pair *c2a;
 	int i, ret = 0;
 
 	/* Ensure we have enough room to save the original addresses */
-- 
2.43.0

Re: [PATCH] i2c: atr: fix race condition caused by static local variable in i2c_atr_map_msgs()

[Luca Ceresoli]

Hello,

+Cc Romain, Cosmin, Tomi

On Thu Oct 29, 2026 at 8:08 AM CET, zhangjiao2 wrote:
> From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
>
> The variable `c2a` in i2c_atr_map_msgs() is declared `static`, which means
> it is shared across all invocations of this function regardless of which
> ATR channel is being serviced. Since each channel has its own
> orig_addrs_lock and alias_pairs_lock mutexes, two threads can execute
> i2c_atr_map_msgs() concurrently on different channels, racing on the
> shared `c2a` pointer.
>
> This can cause:
> - The wrong alias to be used for address translation, sending I2C
>   transactions to the wrong device.
> - The `fixed` flag of an unrelated mapping to be corrupted, breaking the
>   alias replacement logic.
>
> Remove the `static` keyword so that `c2a` becomes a regular local
> variable, eliminating the shared state between concurrent calls.
>
> Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>

Was this potential bug observed on real hardware? I'm a bit surprised
nobody noticed before.

Also, if it's a bugfix, it should have a Fixes: tag and possibly Cc:
stable.

Code-wise it looks OK. Not sure a bug can really happen but I don't see any
reason this variable should be static: it is always set before being read
by this function.

Also please keep Romain, Cosmin and Tomi in Cc in future iterations, they
worked significantly on this code.

Luca

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH] i2c: atr: fix race condition caused by static local variable in i2c_atr_map_msgs()

[Tomi Valkeinen]

On 29/10/2026 10:25, Luca Ceresoli wrote:
> Hello,
> 
> +Cc Romain, Cosmin, Tomi
> 
> On Thu Oct 29, 2026 at 8:08 AM CET, zhangjiao2 wrote:
>> From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
>>
>> The variable `c2a` in i2c_atr_map_msgs() is declared `static`, which means
>> it is shared across all invocations of this function regardless of which
>> ATR channel is being serviced. Since each channel has its own
>> orig_addrs_lock and alias_pairs_lock mutexes, two threads can execute
>> i2c_atr_map_msgs() concurrently on different channels, racing on the
>> shared `c2a` pointer.
>>
>> This can cause:
>> - The wrong alias to be used for address translation, sending I2C
>>    transactions to the wrong device.
>> - The `fixed` flag of an unrelated mapping to be corrupted, breaking the
>>    alias replacement logic.
>>
>> Remove the `static` keyword so that `c2a` becomes a regular local
>> variable, eliminating the shared state between concurrent calls.
>>
>> Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
> 
> Was this potential bug observed on real hardware? I'm a bit surprised
> nobody noticed before.
> 
> Also, if it's a bugfix, it should have a Fixes: tag and possibly Cc:
> stable.
> 
> Code-wise it looks OK. Not sure a bug can really happen but I don't see any
> reason this variable should be static: it is always set before being read
> by this function.
The code change looks valid to me.

I only had a quick look, so take this with a grain of salt, but I think 
i2c_atr_lock_bus() is always taken when i2c_atr_map_msgs() is called. 
Thus the accesses to c2a are serialized in one atr. With multiple atrs 
this might trigger. But I think it's not out of the question that the 
compiler would optimize it to a local variable, based on how it is used 
(but I didn't actually dissassemble).

So, yes, it would be interesting to hear if this was observed on HW or 
just fixing code that looks wrong.

  Tomi