[PATCH] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

[PATCH] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

[Wentao Liang]

i2c_acpi_find_adapter_by_handle() returns the adapter with a reference
obtained via get_device() in bus_find_device(), which the caller is
responsible for dropping. i2c_new_client_device() stores the adapter
pointer without taking a reference and does not release the caller's
reference on any path, so the reference is leaked.

Drop the adapter device reference after creating the client, like
i2c_acpi_notify() does.

Fixes: 53f8f7c5cf14 ("i2c: break out ACPI support into separate file")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/i2c/i2c-core-acpi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index 28c0e4884a7f..5efd1c406bc2 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -544,6 +544,7 @@ struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,
 						 struct i2c_board_info *info)
 {
 	struct i2c_acpi_lookup lookup;
+	struct i2c_client *client;
 	struct i2c_adapter *adapter;
 	struct acpi_device *adev;
 	LIST_HEAD(resource_list);
@@ -572,7 +573,10 @@ struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,
 	if (!adapter)
 		return ERR_PTR(-EPROBE_DEFER);
 
-	return i2c_new_client_device(adapter, info);
+	client = i2c_new_client_device(adapter, info);
+	put_device(&adapter->dev);
+
+	return client;
 }
 EXPORT_SYMBOL_GPL(i2c_acpi_new_device_by_fwnode);
 
-- 
2.34.1

Re: [PATCH] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

[Mika Westerberg]

Hi,

On Wed, Sep 16, 2026 at 03:55:07PM +0000, Wentao Liang wrote:
> i2c_acpi_find_adapter_by_handle() returns the adapter with a reference
> obtained via get_device() in bus_find_device(), which the caller is
> responsible for dropping. i2c_new_client_device() stores the adapter
> pointer without taking a reference and does not release the caller's
> reference on any path, so the reference is leaked.
> 
> Drop the adapter device reference after creating the client, like
> i2c_acpi_notify() does.
> 
> Fixes: 53f8f7c5cf14 ("i2c: break out ACPI support into separate file")

I don't think this is right. The issue existed already before the move.

> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Acked-by: Mika Westerberg <westeri@kernel.org>