dm1105_probe() registers two I2C adapters, the regular adapter and a GPIO bit-banged adapter. The probe failure paths unregister both adapters, but dm1105_remove() only unregisters the regular adapter. As a result, removing the device leaves the GPIO I2C adapter registered after the dm1105 device structure containing it is freed. This can leave the I2C core with references to an adapter whose backing memory has already been released. Unregister the GPIO I2C adapter during remove, matching the cleanup performed by the probe failure paths. This issue was found by manual code inspection. Fixes: 0017505de0d28 ("[media] dm1105: GPIO handling added, I2C on GPIO added, LNB control through GPIO reworked") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/media/pci/dm1105/dm1105.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c index ae4544042a74..ae7954cced0c 100644 --- a/drivers/media/pci/dm1105/dm1105.c +++ b/drivers/media/pci/dm1105/dm1105.c @@ -1195,6 +1195,7 @@ static void dm1105_remove(struct pci_dev *pdev) dvb_dmxdev_release(&dev->dmxdev); dvb_dmx_release(dvbdemux); dvb_unregister_adapter(dvb_adapter); + i2c_del_adapter(&dev->i2c_bb_adap); i2c_del_adapter(&dev->i2c_adap); dm1105_hw_exit(dev); -- 2.43.0