[PATCH 0/5] i2c: fix device_node refcount leaks in 5 bus drivers

[Liu Zhenlong <dragonliu2018@gmail.com>]

This series fixes device_node refcount leaks in 5 i2c bus drivers that
share the same bug pattern:

  adap->dev.of_node = of_node_get(pdev->dev.of_node);

Each driver calls of_node_get() to take an extra reference on the
platform device's of_node when assigning it to the adapter device, but
none of them drop it in the probe error paths nor in the remove()
callback.

device_release() does not call of_node_put(), and
i2c_adapter_dev_release() only completes a struct, so the extra
reference is never released, leaking the device_node on every probe
failure and every adapter removal.

Additionally, in the remove() callbacks, i2c_del_adapter() clears
adap->dev with memset() at the end (commit bd4bc3dbded9 ("i2c: Clear
i2c_adapter.dev on adapter removal")), which zeroes adap->dev.of_node
before of_node_put() runs, turning it into a no-op.  The fix caches the
pointer before calling i2c_del_adapter(), the same approach used in
i2c-mux (i2c_mux_del_adapters) and mtd (commit 56570bdad5e3 ("mtd: core:
Fix refcount error in del_mtd_device()")).

A related fix for the i2c-qcom-cci driver has already been submitted
separately:

  https://lore.kernel.org/linux-i2c/20260815140931.53297-1-dragonliu2018@gmail.com/

These 5 drivers are the remaining i2c bus drivers that use of_node_get()
on the adapter device; all other drivers either assign of_node directly
(without taking an extra reference) or don't use Device Tree at all.

Each patch has its own Fixes: tag pointing to the commit that introduced
of_node_get() in the respective driver, and requests stable backport via
Cc: stable@vger.kernel.org.

Compile-tested with gcc on arm64 defconfig using COMPILE_TEST; no
hardware available for runtime testing.

Liu Zhenlong (5):
  i2c: mpc: fix device_node refcount leak in fsl_i2c_probe()/fsl_i2c_remove()
  i2c: cpm: fix device_node refcount leak in cpm_i2c_probe()/cpm_i2c_remove()
  i2c: ibm_iic: fix device_node refcount leak in iic_probe()/iic_remove()
  i2c: opal: fix device_node refcount leak in i2c_opal_probe/remove()
  i2c: pnx: fix device_node refcount leak in i2c_pnx_probe()/i2c_pnx_remove()

 drivers/i2c/busses/i2c-cpm.c     |  3 +++
 drivers/i2c/busses/i2c-ibm_iic.c |  4 ++++
 drivers/i2c/busses/i2c-mpc.c     |  6 +++++-
 drivers/i2c/busses/i2c-opal.c    |  6 +++++-
 drivers/i2c/busses/i2c-pnx.c     | 15 ++++++++++++---
 5 files changed, 29 insertions(+), 5 deletions(-)

--
2.55.0