diff options
| author | Raag Jadav <raag.jadav@intel.com> | 2026-09-11 17:45:47 +0530 |
|---|---|---|
| committer | Matt Roper <matthew.d.roper@intel.com> | 2026-09-14 07:50:20 -0700 |
| commit | 8ba5c8b8ab3fd362267c11df2cd5a90ee46f6e24 (patch) | |
| tree | a049659a20575a4fb421e563ea3b8eac6ed02234 | |
| parent | 7dbd24e9d5311b6afdbdd875dd247ab5ff54edca (diff) | |
| download | linux-next-8ba5c8b8ab3fd362267c11df2cd5a90ee46f6e24.tar.gz linux-next-8ba5c8b8ab3fd362267c11df2cd5a90ee46f6e24.zip | |
drm/xe/i2c: Disable IRQ on unbind
Currently, struct xe_i2c is freed before SGUnit IRQ is disabled in unbind
path, leaving a potential UAF in case I2C IRQ is hit during this small
window. Explicitly disable I2C IRQ in xe_i2c_remove() and fix this.
Fixes: 0bb78ce09926 ("drm/xe/i2c: Wire up reset/postinstall for I2C IRQ")
Signed-off-by: Raag Jadav <raag.jadav@intel.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260911121547.2407261-1-raag.jadav@intel.com
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
| -rw-r--r-- | drivers/gpu/drm/xe/xe_i2c.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/gpu/drm/xe/xe_i2c.c b/drivers/gpu/drm/xe/xe_i2c.c index d8fa68206f41..51ca9fb73b70 100644 --- a/drivers/gpu/drm/xe/xe_i2c.c +++ b/drivers/gpu/drm/xe/xe_i2c.c @@ -324,8 +324,10 @@ void xe_i2c_pm_resume(struct xe_device *xe, bool d3cold) static void xe_i2c_remove(void *data) { struct xe_i2c *i2c = data; + struct xe_device *xe = tile_to_xe(i2c->mmio->tile); unsigned int i; + xe_i2c_irq_reset(xe); xe_amc_exit(i2c); for (i = 0; i < XE_I2C_MAX_CLIENTS; i++) { @@ -335,6 +337,7 @@ static void xe_i2c_remove(void *data) bus_unregister_notifier(&i2c_bus_type, &i2c->bus_notifier); xe_i2c_unregister_adapter(i2c); + xe->i2c = NULL; } /** |