Re: [PATCH] i2c: atr: fix dangling adapter pointer on add failure

On Thu, Aug 06, 2026 at 03:35:45PM +0800, Linkai Gong wrote:
> i2c_atr_add_adapter() stores atr->adapter[chan_id] before
> i2c_add_adapter() so that the I2C bus notifier can match child clients
> during registration. On failure the channel is freed but the slot was
> left pointing at freed memory, which can lead to use-after-free in
> i2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST.
> 
> Clear the slot on the i2c_add_adapter() error path before freeing chan.

Reviewed-by: Andy Shevchenko <[email protected]>

...

>  	if (ret) {
>  		dev_err(dev, "failed to add atr-adapter %u (error=%d)\n",
>  			chan_id, ret);
> +		atr->adapter[chan_id] = NULL;

It's better to NULLify first and print after. This will reduce the window of
possible calls with the stale pointer.

>  		goto err_free_alias_pool;
>  	}

-- 
With Best Regards,
Andy Shevchenko