[PATCH v2] drm/i915/dsi: fix i2c adapter reference leak in i2c_adapter_lookup()

[PATCH v2] drm/i915/dsi: fix i2c adapter reference leak in i2c_adapter_lookup()

[Ma Ke]

i2c_adapter_lookup() acquires a reference on the i2c adapter through
i2c_acpi_find_adapter_by_handle() but not releases it.  Each
invocation of this ACPI resource callback leaks one device reference,
potentially leading to resource exhaustion over repeated driver
load/unload cycles.

Calling path: i2c_acpi_find_adapter_by_handle() -> bus_find_device()
-> get_device.

Found by code review.

Signed-off-by: Ma Ke <make_ruc2021@163.com>
Cc: stable@vger.kernel.org
Fixes: 8cbf89db2941 ("drm/i915/dsi: Parse the I2C element from the VBT MIPI sequence block (v3)")
---
Changes in v2:
- Changed email to trigger CI, no code change.
---
 drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
index fe12041e913c..2097c5d17cb7 100644
--- a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
+++ b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
@@ -460,8 +460,10 @@ static int i2c_adapter_lookup(struct acpi_resource *ares, void *data)
 		return 1;
 
 	adapter = i2c_acpi_find_adapter_by_handle(adapter_handle);
-	if (adapter)
+	if (adapter) {
 		intel_dsi->i2c_bus_num = adapter->nr;
+		put_device(&adapter->dev);
+	}
 
 	return 1;
 }
-- 
2.43.0

Re: [PATCH v2] drm/i915/dsi: fix i2c adapter reference leak in i2c_adapter_lookup()

[Jani Nikula]

On Thu, 18 Jun 2026, Ma Ke <make_ruc2021@163.com> wrote:
> i2c_adapter_lookup() acquires a reference on the i2c adapter through
> i2c_acpi_find_adapter_by_handle() but not releases it.  Each
> invocation of this ACPI resource callback leaks one device reference,
> potentially leading to resource exhaustion over repeated driver
> load/unload cycles.
>
> Calling path: i2c_acpi_find_adapter_by_handle() -> bus_find_device()
> -> get_device.
>
> Found by code review.
>
> Signed-off-by: Ma Ke <make_ruc2021@163.com>
> Cc: stable@vger.kernel.org
> Fixes: 8cbf89db2941 ("drm/i915/dsi: Parse the I2C element from the VBT MIPI sequence block (v3)")
> ---
> Changes in v2:
> - Changed email to trigger CI, no code change.

Sorry, that won't do anything. Please just let us deal with it. :)

BR,
Jani.

> ---
>  drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
> index fe12041e913c..2097c5d17cb7 100644
> --- a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
> +++ b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
> @@ -460,8 +460,10 @@ static int i2c_adapter_lookup(struct acpi_resource *ares, void *data)
>  		return 1;
>  
>  	adapter = i2c_acpi_find_adapter_by_handle(adapter_handle);
> -	if (adapter)
> +	if (adapter) {
>  		intel_dsi->i2c_bus_num = adapter->nr;
> +		put_device(&adapter->dev);
> +	}
>  
>  	return 1;
>  }

-- 
Jani Nikula, Intel

Re: [PATCH v2] drm/i915/dsi: fix i2c adapter reference leak in i2c_adapter_lookup()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing memory leak of an I2C adapter device reference in i2c_acpi_new_device_by_fwnode().
--

commit 66de974c089b4da323236a8e423198078a9b4d70
Author: Ma Ke <make_ruc2021@163.com>

drm/i915/dsi: fix i2c adapter reference leak in i2c_adapter_lookup()

This commit fixes an I2C adapter device reference leak in
i2c_adapter_lookup() by adding a put_device() call to release the
reference acquired by i2c_acpi_find_adapter_by_handle().

> diff --git a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
> index fe12041e913cd..2097c5d17cb7a 100644
> --- a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
> +++ b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c
> @@ -460,8 +460,10 @@ static int i2c_adapter_lookup(struct acpi_resource *ares, void *data)
>  		return 1;
>  
>  	adapter = i2c_acpi_find_adapter_by_handle(adapter_handle);
> -	if (adapter)
> +	if (adapter) {
>  		intel_dsi->i2c_bus_num = adapter->nr;
> +		put_device(&adapter->dev);
> +	}
>  
>  	return 1;
>  }

[Severity: High]
This is a pre-existing issue, but while reviewing this fix, it appears the
same leak exists in the I2C ACPI core.

Does i2c_acpi_new_device_by_fwnode() in drivers/i2c/i2c-core-acpi.c also need
to release the adapter reference?

drivers/i2c/i2c-core-acpi.c:i2c_acpi_new_device_by_fwnode() {
    ...
	adapter = i2c_acpi_find_adapter_by_handle(lookup.adapter_handle);
	if (!adapter)
		return ERR_PTR(-EPROBE_DEFER);

	return i2c_new_client_device(adapter, info);
}

The adapter reference is acquired through bus_find_device() internally but
never released.

Since i2c_del_adapter() waits for the adapter's reference count to reach zero
via wait_for_completion(&adap->dev_released), could this leak cause any
subsequent attempts to unbind or remove the underlying I2C adapter to hang
forever in uninterruptible sleep, blocking system power management
transitions?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260618110446.518501-1-make_ruc2021@163.com?part=1