From 85ee622a4cb88ecdcd2151c54acbb6fa7b7c470e Mon Sep 17 00:00:00 2001
From: Dmitry Ilyin <6576495+widgetii@users.noreply.github.com>
Date: Mon, 31 Aug 2026 19:03:26 +0300
Subject: [PATCH] sensors: close the descriptor getsensorid() opens to test the
 bus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`getsensorid()` opens the i2c adapter to find out whether it is there,
and then never closes it. The probes it goes on to run open the adapter
again and close what they open (`get_sensor_id_i2c()` ends in
`close_sensor_fd(fd)`), so nothing needs the descriptor taken here — it
is a pure leak, one per call, and up to six once the fall-through loop
starts sweeping the other adapters.

That is invisible for `ipctool`, which runs once and exits. It is not
invisible for a daemon: majestic probes the sensor at every pipeline
start *and* every SIGHUP reload, so a camera accumulates one open
`/dev/i2c-N` per reload for the life of the process. Enough of them and
`open()` and `accept()` start failing process-wide — which presents as a
streamer that is still running, still holding its ports, and answering
nothing, rather than as a descriptor leak.

Measured on a lab ssc30kq (SigmaStar infinity6e, imx335), majestic
master:

| | `/dev/i2c-1` descriptors held |
|---|---|
| before, 26 reloads | 29 |
| before, 7 more reloads | 36 |
| with `$SENSOR` set, probe skipped, 5 reloads | 0 |
| after this change, 8 reloads | 0 |

The `$SENSOR` row is the control: it takes majestic's own path out of
the picture and pins the leak on the probe.

The test becomes `fd < 0` rather than `!fd`. `open()` reports failure as
-1, so the old form read a failed open as success and only the
impossible descriptor 0 as failure; the run then fell through to
`get_sensor_id_i2c()`, which opened the adapter properly and failed
there instead. No behaviour depended on the old spelling.

Control flow is otherwise unchanged, deliberately: the fall-through loop
still gives up on the first adapter it cannot open rather than skipping
to the next one. Making that sweep actually sweep is a change to what
gets detected, and it does not belong in a leak fix.
---
 src/sensors.c | 32 ++++++++++++++++++++++++++++----
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/src/sensors.c b/src/sensors.c
index 50c1dd0..a855602 100644
--- a/src/sensors.c
+++ b/src/sensors.c
@@ -1189,6 +1189,30 @@ static bool get_sensor_id_spi(sensor_ctx_t *ctx) {
     return res;
 }
 
+/* Is the bus there at all? A liveness check and nothing more: the probes below
+ * (get_sensor_id_i2c) open the adapter again and close what they opened, so the
+ * descriptor taken here has no further use.
+ *
+ * It used to be taken and dropped on the floor. getsensorid() runs afresh on
+ * every pipeline reload, so a long-lived caller leaked one /dev/i2c-N
+ * descriptor per reload — and up to six, once the fall-through loop below
+ * started sweeping the other adapters. Enough of them and open()/accept() start
+ * failing process-wide, which for a daemon looks like a camera that is still
+ * running and has stopped answering rather than like a descriptor leak.
+ * Measured on a lab ssc30kq: exactly one per SIGHUP before, none after.
+ *
+ * The test is `fd < 0`, not the `!fd` it replaces: open() reports failure as
+ * -1, so the old form read a failed open as success and only the impossible
+ * descriptor 0 as failure. */
+static bool i2c_bus_openable(int adapter_nr) {
+    int fd = open_i2c_sensor_fd(adapter_nr);
+    if (fd < 0)
+        return false;
+
+    close_sensor_fd(fd);
+    return true;
+}
+
 bool getsensorid(sensor_ctx_t *ctx) {
 
 int current_i2c_adapter_nr;
@@ -1206,8 +1230,8 @@ int current_i2c_adapter_nr;
         hal_enable_sensor_clock();
 
     // there is no platform specific i2c/spi access layer
-    if (!open_i2c_sensor_fd(i2c_adapter_nr))
-        return NULL;
+    if (!i2c_bus_openable(i2c_adapter_nr))
+        return false;
 
     // Use common settings as default
     ctx->data_width = 1;
@@ -1236,8 +1260,8 @@ for (int i = 0; i <= 5; i++) {
 i2c_adapter_nr = i;
 					
    
-if (!open_i2c_sensor_fd(i2c_adapter_nr))
-        return NULL;
+if (!i2c_bus_openable(i2c_adapter_nr))
+        return false;
 
     // Use common settings as default
     ctx->data_width = 1;