Re: [PATCH] i2c: fix use-after-free in debugfs directory during adapter removal

[Andi Shyti]

Hi Yun,

On Wed, Jul 29, 2026 at 04:58:53PM +0800, Yun Zhou wrote:
> Move debugfs_remove_recursive() after device_unregister() in
> i2c_del_adapter() to fix a race condition where a new i2c device probe
> can access the adapter's already-freed debugfs dentry.
> 
> The race occurs when:
> 1. i2c_del_adapter() calls debugfs_remove_recursive(adap->debugfs),
>    freeing the debugfs dentry.
> 2. Before device_unregister() completes, another thread writes to the
>    sysfs 'new_device' attribute, triggering i2c_device_probe().
> 3. i2c_device_probe() calls debugfs_create_dir() with the stale
>    adapter->debugfs pointer, causing a GPF in start_dirop() when
>    trying to lock the freed inode.
> 
> Reported-by: syzbot+1e3d934ee3cff1ac188b@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=1e3d934ee3cff1ac188b
> Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yun Zhou <yun.zhou@xxxxxxxxxxxxx>

This is the third patch of this kind I've reviewed, starting from
the latest. I'm sorry, but I don't need AI to send me patches; I
can do that myself. I don't need intermediaries.

If your goal is to be replaced by AI, you're doing a pretty good
job.

I'm NAKing this patch on principle. Read your second patch to
understand why; read your own patches and understand them before
sending.

Andi