Re: [PATCH] i2c: prevent new device registration during adapter removal

Hi Yun,

uuhh... woow, check this patch here[*]. Your AI agents look to be
in sync.

I read Vasileios patch first and then yours.

On Thu, Jul 30, 2026 at 03:18:31PM +0800, Yun Zhou wrote:
> Remove new_device and delete_device sysfs attributes early in
> i2c_del_adapter() to prevent concurrent client registrations during
> adapter teardown. Without this, a racing new_device_store() can
> register a client that will never be cleaned up, causing
> wait_for_completion() to block indefinitely.

You can also mention the UAF that Vasileios AI found.

> Fixes: 99cd8e25875a ("i2c: Add a sysfs interface to instantiate devices")
> Cc: [email protected]
> Signed-off-by: Yun Zhou <[email protected]>
> ---
>  drivers/i2c/i2c-core-base.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
> index 3ec04787a737..0f207520d6f9 100644
> --- a/drivers/i2c/i2c-core-base.c
> +++ b/drivers/i2c/i2c-core-base.c
> @@ -1817,6 +1817,14 @@ void i2c_del_adapter(struct i2c_adapter *adap)
>  
>  	i2c_acpi_remove_space_handler(adap);
>  
> +	/*
> +	 * Remove new_device/delete_device sysfs attrs early to prevent
> +	 * new client registrations via userspace while we're tearing down.
> +	 * kernfs will wait for any in-flight writes to complete.
> +	 */
> +	device_remove_file(&adap->dev, &dev_attr_new_device);
> +	device_remove_file(&adap->dev, &dev_attr_delete_device);

I prefer this fix, though, but I don't think we need to manually
remove delete_device.

Andi

[*] https://patchwork.ozlabs.org/project/linux-i2c/patch/[email protected]/

> +
>  	i2c_deregister_clients(adap);
>  
>  	/* device name is gone after device_unregister */
> -- 
> 2.43.0
>