Re: [PATCH v2] i2c: atr: fix dangling adapter pointer on add failure

[Andi Shyti]

Hi Linkai,

On Mon, Sep 07, 2026 at 03:11:02PM +0800, Linkai Gong wrote:
> i2c_atr_add_adapter() stores atr->adapter[chan_id] before
> i2c_add_adapter() so that the I2C bus notifier can match child clients
> during registration. On failure the channel is freed but the slot was
> left pointing at freed memory, which can lead to use-after-free in
> i2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST.
> 
> Clear the slot on the i2c_add_adapter() error path before freeing chan.
> 
> Fixes: a076a860acae ("media: i2c: add I2C Address Translator (ATR) support")
> Signed-off-by: Linkai Gong <gonglinkai@xxxxxxxxxx>
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>

pushed to i2c/i2c-fixes.

Please, next time don't send v2 as --in-reply-to.

Thank you,
Andi