Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) client-ip=23.128.96.37;
From:   Herve Codina <herve.codina@bootlin.com>
To:     Wolfram Sang <wsa+renesas@sang-engineering.com>,
        Peter Rosin <peda@axentia.se>
Cc:     linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org,
        Allan Nielsen <allan.nielsen@microchip.com>,
        Horatiu Vultur <horatiu.vultur@microchip.com>,
        Steen Hegelund <steen.hegelund@microchip.com>,
        Thomas Petazzoni <thomas.petazzoni@bootlin.com>,
        Herve Codina <herve.codina@bootlin.com>
Subject: [PATCH 0/3] Fix i2c mux module refcount issues
Date:   Thu, 19 Oct 2023 09:35:27 +0200
Message-ID: <20231019073533.386563-1-herve.codina@bootlin.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Hi,

Some i2c mux drivers wrongly use the pair of_find_i2c_adapter_by_node()
/ i2c_put_adapter() to lock the parent adapter.

Indeed, i2c_put_adapter() decrements the module refcount while
of_find_i2c_adapter_by_node() does not increment it. This leads to an
overflow over zero of the parent adapter user counter.

Identified mux drivers impacted are:
- i2c-mux-gpmux
- i2c-demux-pinctrl
- i2c-mux-pinctrl

Commit 48e9743dd648 ("i2c: core: add and export of_get_i2c_adapter_by_node()
interface") introduces of_get_i2c_adapter_by_node() to correctly handle
this refcount issue.

This series fixes the 3 identified mux drivers replacing the
of_find_i2c_adapter_by_node() call by an of_get_i2c_adapter_by_node()
call.

Best regards,
Hervé

Herve Codina (3):
  i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
  i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
  i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()

 drivers/i2c/muxes/i2c-demux-pinctrl.c | 2 +-
 drivers/i2c/muxes/i2c-mux-gpmux.c     | 2 +-
 drivers/i2c/muxes/i2c-mux-pinctrl.c   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

-- 
2.41.0