i2c: core: fix adapter deregistration race

Adapters can be looked up by their id using i2c_get_adapter() which
takes a reference to the embedded struct device.

Remove the adapter from the IDR before tearing it down during
deregistration (and on registration failure) to make sure its resources
are not accessed after having been freed (e.g. the device name).

Fixes: 35fc37f81881 ("i2c: Limit core locking to the necessary sections")
Cc: stable@vger.kernel.org	# 2.6.31
Cc: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>

diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 01a984d3ca0e2228121a3e830fcbf3bc3fe9ff95..38f425aecef869ceda41403696e0176e8db16120 100644 (file)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1587,7 +1587,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
        res = device_add(&adap->dev);
        if (res) {
                pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
-               goto err_remove_debugfs;
+               goto err_replace_id;
        }
 
        res = i2c_setup_smbus_alert(adap);
@@ -1614,7 +1614,10 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
 out_reg:
        i2c_deregister_clients(adap);
        device_del(&adap->dev);
-err_remove_debugfs:
+err_replace_id:
+       mutex_lock(&core_lock);
+       idr_replace(&i2c_adapter_idr, NULL, adap->nr);
+       mutex_unlock(&core_lock);
        debugfs_remove_recursive(adap->debugfs);
        pm_runtime_disable(&adap->dev);
 err_put_adap:
@@ -1804,6 +1807,8 @@ void i2c_del_adapter(struct i2c_adapter *adap)
        /* First make sure that this adapter was ever added */
        mutex_lock(&core_lock);
        found = idr_find(&i2c_adapter_idr, adap->nr);
+       if (found == adap)
+               idr_replace(&i2c_adapter_idr, NULL, adap->nr);
        mutex_unlock(&core_lock);
        if (found != adap) {
                pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);