From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0ABA430FC1F for ; Sat, 15 Aug 2026 14:09:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786802996; cv=none; b=PLMc+eDNkTDtuGDicGEGAs/Mh3gmVci5bhuX1BfSQKaCKs3VpT+dRGXmg3K2ZNcPRTIHxQtWqGWYUN4hVFW4hdbyjCd7VskXMjoEbsqxHLLMUU5efKR6BZv8rixWh2ElLmwx1wTRvkrsm0/Vb7iECz+J040wqKBn0VaWXAf6Nbc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786802996; c=relaxed/simple; bh=S1LKiqQSNMlXcxi2Yv2UEG7wi3iotbbEkUf1MkDP2wc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=iwEFlTBpGIaDM6M/4vZWoxZVly2fzzKxugQe4oGKOEYA1o3+ot3xSmaGPaQXGBakoDgEh6IsxdjBxGyHRZJd5RWyy8FX9uodShJCVJWAeBtSKiSg27f7AiKHHJW9IXha2+4aE07KT9VquEdE/CK7GquKu8AZ1RSZ37CS1e8IiNY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MIX0byll; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MIX0byll" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-38e07ebd263so1364111a91.1 for ; Sat, 15 Aug 2026 07:09:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786802993; x=1787407793; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=rk+TK55LIKRB93LVwwGii2OByDhMrzrdTRJzsNIADDg=; b=MIX0byll+ZOae0HS3sebYFKi2Mub5gXColQEUuIeFFiPYx9fbclCfMh9VVaIZ+eYzl nHomhK5W51AXjicsG4O5FoJ6BbOvUZWKfKK2UkEwYL50XVJIULq40i0XReGfTvShqjta 1PwcIkOQyE9ifGvuwv4AkwWi1EXTUSLqHwC3x4hIJMtxfkDjEHrXxfZRKEUS8eOAUNew u6d82DUHSCFJa4z6OM1+0XRI8rhnvXNcxczYSK6wy2UCfF2Coftn42aWwdKndxg9xPSS mSc38rBMe6IgI3a964RQpWGBXDi/rYAIYOv3W7nstwYtTp2IE4Yp5pSGDjmdtnONPDh4 T3lA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786802993; x=1787407793; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=rk+TK55LIKRB93LVwwGii2OByDhMrzrdTRJzsNIADDg=; b=os/kfWCpCYeMiq2eiW3IpURv83McoA1kQ9CTq5v3jsQ93sV/o1SYnoo7qn6foo/CRj vqTY5PpV1BXmfC+hZlHim9VoedTfCS2ANRGlUT9OApN25LPQii2FEfwmcCrMZyNOmtsS 9YjMT11x0xNSByOtclCz1lpjrMPZK/SmBSw7TeEZcbLWJo4o9k10PwPRx2lha0hORxwn ahsq5EcOqAL8NflUwAor2uB1dJ++x5eHEQyG5L1tcrOX8S54aNH+T5nWqQ8wajg1eVjr p96/AYwZmiOLZCdmE4Yhv8p/lSRtjCgU+GATe9/a0RFUds0PHvHyCRhFZPWEwpp+uIWk cZgA== X-Forwarded-Encrypted: i=1; AHgh+Rrqt72aS+f4fynYDW3MqbFJoe2hQau86HTMrvRpDuIA20hhRI6zgrAzGDy2wGQD8zSl86c2EHC5SU6RZII=@vger.kernel.org X-Gm-Message-State: AOJu0Yx9l9OppGqcN7f8pLU6ymvYt+Nwy5a7LAiEycRpYIIsx3NtaRlC ueRx/REJN/LWjfgWggrX8YA7A/ySrPYPH4LsMQl/+Ok6eykAV3GQl6Ky X-Gm-Gg: AR+sD12155opmnsqlHSiDcRdhKHMizr0Zi9pz8FcsEJcazVPnzJ505oCArlXwgKBgyR NIbKqxH+SQC6GCiL4qIJhMp3jsaYUCgje4n59p7xWufPihlQBIWtpeWYK1MR3LuokKbiqmvsDaf i1fKa7hxFzs+k6Zzb0vooGzs6LmvlPSIr84MQLhB5EK3LL0ONZMaaXZKj52EZam5G7Vr1QKDV7a P5H81a29JMZtOCWo6FpkaVUcel1qYOIXron8QfhYTK1+viEWgP8dF/xOnOGRefcF9pbtZwezWUb 8hOp9Gy/ENEteP8k/Ga+gEQgKiE5W9K4bPRAS2DvWWNxajxCzjeVt0Qt0+lpPPMKg2wD+TzlIsP OiKltxLB0JLG3R7VyJiPLnubaamYkDPNId6zUUMgmGnLqeDLptPHkLGIUHy5nPBhB3NkdbxylM8 7hZw8djei38o579dsq7X6AwU/cOmLuwQO/wO3ubUwuUx/La3033UywuzCgYVH3Sws3nWh7ItLdR vtYUZu9O2p6FavIerhQoNl0h/k= X-Received: by 2002:a17:90b:2888:b0:37f:a915:1c29 with SMTP id 98e67ed59e1d1-3933b95dbb3mr15321257a91.19.1786802993171; Sat, 15 Aug 2026 07:09:53 -0700 (PDT) Received: from localhost.localdomain ([240a:4280:4800:6ace:25e8:2607:e94d:caaf]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-394ea996575sm6327788a91.8.2026.08.15.07.09.49 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 15 Aug 2026 07:09:52 -0700 (PDT) From: Liu Zhenlong To: loic.poulain@oss.qualcomm.com, rfoss@kernel.org, andi.shyti@kernel.org Cc: vladimir.zapolskiy@linaro.org, wsa@kernel.org, andersson@kernel.org, linux-i2c@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Liu Zhenlong , stable@vger.kernel.org Subject: [PATCH] i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() Date: Sat, 15 Aug 2026 22:09:31 +0800 Message-ID: <20260815140931.53297-1-dragonliu2018@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit cci_probe() calls of_node_get() to take an extra reference on the child device_node when assigning it to the adapter device. The matching of_node_put() calls exist in both the error cleanup path and cci_remove(), but they are placed after i2c_del_adapter(). i2c_del_adapter() clears adap->dev with memset() at the end (commit bd4bc3dbded9 ("i2c: Clear i2c_adapter.dev on adapter removal")), which zeroes adap->dev.of_node before of_node_put() runs, turning it into a no-op. The reference taken by of_node_get() is never released, leaking the device_node on every cleanup of already-registered adapters and every adapter removal. The commit that added of_node_get() and the matching of_node_put() calls placed the puts after i2c_del_adapter(), so the bug has been present since the fix was introduced. Cache the pointer before calling i2c_del_adapter(), the same approach used in i2c-mux (i2c_mux_del_adapters) and mtd (commit 56570bdad5e3 ("mtd: core: Fix refcount error in del_mtd_device()")). The of_node_put() in the i2c_add_adapter() failure path (before any i2c_del_adapter() runs) is correct and left unchanged. Fixes: 02a4a69667a2 ("i2c: qcom-cci: don't put a device tree node before i2c_add_adapter()") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Liu Zhenlong --- drivers/i2c/busses/i2c-qcom-cci.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/busses/i2c-qcom-cci.c b/drivers/i2c/busses/i2c-qcom-cci.c index bdeda3979c48..61c535b8196f 100644 --- a/drivers/i2c/busses/i2c-qcom-cci.c +++ b/drivers/i2c/busses/i2c-qcom-cci.c @@ -618,8 +618,10 @@ static int cci_probe(struct platform_device *pdev) for (--i ; i >= 0; i--) { if (cci->master[i].cci) { + struct device_node *node = cci->master[i].adap.dev.of_node; + i2c_del_adapter(&cci->master[i].adap); - of_node_put(cci->master[i].adap.dev.of_node); + of_node_put(node); } } disable_clocks: @@ -635,8 +637,10 @@ static void cci_remove(struct platform_device *pdev) for (i = 0; i < cci->data->num_masters; i++) { if (cci->master[i].cci) { + struct device_node *node = cci->master[i].adap.dev.of_node; + i2c_del_adapter(&cci->master[i].adap); - of_node_put(cci->master[i].adap.dev.of_node); + of_node_put(node); cci_halt(cci, i); } } -- 2.55.0