i2c: core: fix debugfs UAF on adapter removal
From: Vasileios Almpanis
Date: Wed Aug 12 2026 - 03:29:19 EST
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 0131b508c0e2489eac6e121135988f6eeb716f19
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 3ec04787a737..17cf3d225268 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1815,6 +1815,12 @@ void i2c_del_adapter(struct i2c_adapter *adap)
return;
}
+ /*
+ * This drains any in-flight writers, so all
+ * clients will be caught by i2c_deregister_clients().
+ */
+ device_remove_file(&adap->dev, &dev_attr_new_device);
+
i2c_acpi_remove_space_handler(adap);
i2c_deregister_clients(adap);