From: Jamie Iles quic_jiles@quicinc.com

mainline inclusion from mainline-v5.15-rc5 commit 6558b646ce1c2a872fe1c2c7cb116f05a2c1950f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O7 CVE: CVE-2021-47425

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

----------------------------------------------------

acpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a reference on the adapter which is never released which will result in a reference count leak and render the adapter unremovable. Make sure to put the adapter after creating the client in the same manner that we do for OF.

Fixes: 525e6fabeae2 ("i2c / ACPI: add support for ACPI reconfigure notifications") Signed-off-by: Jamie Iles quic_jiles@quicinc.com Acked-by: Mika Westerberg mika.westerberg@linux.intel.com [wsa: fixed title] Signed-off-by: Wolfram Sang wsa@kernel.org Signed-off-by: Zeng Heng zengheng4@huawei.com --- drivers/i2c/i2c-core-acpi.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c index 559c3b1284d7..2db4c49bee77 100644 --- a/drivers/i2c/i2c-core-acpi.c +++ b/drivers/i2c/i2c-core-acpi.c @@ -377,6 +377,7 @@ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, break;

i2c_acpi_register_device(adapter, adev, &info); + put_device(&adapter->dev); break; case ACPI_RECONFIG_DEVICE_REMOVE: if (!acpi_device_enumerated(adev))