[PATCH] i2c: atr: fix race condition caused by static local variable in i2c_atr_map_msgs()

From: zhangjiao2

Date: Thu Oct 29 2026 - 03:11:31 EST


From: zhang jiao <zhangjiao2@xxxxxxxxxxxxxxxxxxxx>

The variable `c2a` in i2c_atr_map_msgs() is declared `static`, which means
it is shared across all invocations of this function regardless of which
ATR channel is being serviced. Since each channel has its own
orig_addrs_lock and alias_pairs_lock mutexes, two threads can execute
i2c_atr_map_msgs() concurrently on different channels, racing on the
shared `c2a` pointer.

This can cause:
- The wrong alias to be used for address translation, sending I2C
transactions to the wrong device.
- The `fixed` flag of an unrelated mapping to be corrupted, breaking the
alias replacement logic.

Remove the `static` keyword so that `c2a` becomes a regular local
variable, eliminating the shared state between concurrent calls.

Signed-off-by: zhang jiao <zhangjiao2@xxxxxxxxxxxxxxxxxxxx>
---
drivers/i2c/i2c-atr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-atr.c b/drivers/i2c/i2c-atr.c
index e6d2af659d81..c9ad46db438d 100644
--- a/drivers/i2c/i2c-atr.c
+++ b/drivers/i2c/i2c-atr.c
@@ -360,7 +360,7 @@ static int i2c_atr_map_msgs(struct i2c_atr_chan *chan, struct i2c_msg *msgs,
int num)
{
struct i2c_atr *atr = chan->atr;
- static struct i2c_atr_alias_pair *c2a;
+ struct i2c_atr_alias_pair *c2a;
int i, ret = 0;

/* Ensure we have enough room to save the original addresses */
--
2.43.0