Re: [PATCH 1/5] i2c: mpc: fix device_node refcount leak in fsl_i2c_probe()/fsl_i2c_remove()

Hi Liu

On 16/08/2026 06:12, Liu Zhenlong wrote:
> fsl_i2c_probe() calls of_node_get() to take an extra reference on the
> platform device's of_node when assigning it to the adapter device, but
> neither the probe error path nor fsl_i2c_remove() drops it.
>
> device_release() does not call of_node_put() and i2c_adapter_dev_release()
> only completes a struct, so the extra reference is never released, leaking
> the device_node on every probe failure and every adapter removal.
>
> Add the matching of_node_put() to both paths.
>
> In the probe error path, i2c_add_numbered_adapter() failure does not run
> i2c_del_adapter(), so of_node_put(i2c->adap.dev.of_node) is safe.
>
> In fsl_i2c_remove(), i2c_del_adapter() clears adap->dev with memset() at
> the end (commit bd4bc3dbded9 ("i2c: Clear i2c_adapter.dev on adapter
> removal")), which zeroes adap->dev.of_node before of_node_put() runs,
> turning it into a no-op.  Cache the pointer before calling
> i2c_del_adapter(), the same approach used in i2c-mux
> (i2c_mux_del_adapters) and mtd (commit 56570bdad5e3 ("mtd: core: Fix
> refcount error in del_mtd_device()")).
>
> Compile-tested with gcc-powerpc-linux-gnu on pmac32 defconfig; no
> hardware available for runtime testing.
>
> Fixes: 9fd049927ccb ("of/i2c: Generalize OF support")
> Cc: [email protected]
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Liu Zhenlong <[email protected]>

I did wonder if there was a better way of fixing this generically since 
it affects multiple drivers e.g. doing the put in i2c_del_adapter(), 
adding a devm_ function than deals with the reference or just not 
acquiring the reference (which seems to be what SPI does).

Regardless for an older driver like i2c-mpc this is probably a minimally 
sane fix.

Reviewed-by: Chris Packham <[email protected]>

> ---
>   drivers/i2c/busses/i2c-mpc.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
> index a21fa45bd64c..8182f7dc3d0f 100644
> --- a/drivers/i2c/busses/i2c-mpc.c
> +++ b/drivers/i2c/busses/i2c-mpc.c
> @@ -867,8 +867,10 @@ static int fsl_i2c_probe(struct platform_device *op)
>   	i2c_set_adapdata(&i2c->adap, i2c);
>   
>   	result = i2c_add_numbered_adapter(&i2c->adap);
> -	if (result)
> +	if (result) {
> +		of_node_put(i2c->adap.dev.of_node);
>   		return result;
> +	}
>   
>   	return 0;
>   };
> @@ -876,8 +878,10 @@ static int fsl_i2c_probe(struct platform_device *op)
>   static void fsl_i2c_remove(struct platform_device *op)
>   {
>   	struct mpc_i2c *i2c = platform_get_drvdata(op);
> +	struct device_node *node = i2c->adap.dev.of_node;
>   
>   	i2c_del_adapter(&i2c->adap);
> +	of_node_put(node);
>   };
>   
>   static int __maybe_unused mpc_i2c_suspend(struct device *dev)