[PATCH] Input: Fix i2c_bus OF node reference leak in ppkb_probe()

[PATCH] Input: Fix i2c_bus OF node reference leak in ppkb_probe()

[Wentao Liang]

The device node reference returned by of_get_child_by_name() is
stored as the adapter's of_node but never released, leaking one node
reference on every probe, successful or not.

The adapter only borrows the node, so drop the reference once the
adapter has been added, and also on the error path.

Fixes: 63c5eb157cfd ("Input: pinephone-keyboard - support the proxied I2C bus")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/input/keyboard/pinephone-keyboard.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/input/keyboard/pinephone-keyboard.c b/drivers/input/keyboard/pinephone-keyboard.c
index 147b1f288a33..c82323713be8 100644
--- a/drivers/input/keyboard/pinephone-keyboard.c
+++ b/drivers/input/keyboard/pinephone-keyboard.c
@@ -384,8 +384,10 @@ static int ppkb_probe(struct i2c_client *client)
 		error = devm_i2c_add_adapter(dev, &ppkb->adapter);
 		if (error) {
 			dev_err(dev, "Failed to add I2C adapter: %d\n", error);
+			of_node_put(i2c_bus);
 			return error;
 		}
+		of_node_put(i2c_bus);
 	}
 
 	crc8_populate_msb(ppkb->crc_table, PPKB_CRC8_POLYNOMIAL);
-- 
2.34.1

Re: [PATCH] Input: Fix i2c_bus OF node reference leak in ppkb_probe()

[Dmitry Torokhov]

Hi Wentao,

On Wed, Sep 16, 2026 at 06:47:21PM +0000, Wentao Liang wrote:
> The device node reference returned by of_get_child_by_name() is
> stored as the adapter's of_node but never released, leaking one node
> reference on every probe, successful or not.
> 
> The adapter only borrows the node, so drop the reference once the
> adapter has been added, and also on the error path.

I do not think this is correct fix. The node assigned to the adapter
should stay alive while the adapter is alive.

I think we should convert of_node to fwnode, use device_set_node() to
make sure both fwnode and of_node are pointing to the same thing, and
set up devm_add_action_or_reset() to free the fwnode at the right time. 

Thanks.

-- 
Dmitry

[PATCH v2] Input: pinephone-keyboard - fix firmware node reference leak

[Wentao Liang]

of_get_child_by_name() returns a reference which is stored in the
adapter's device but never released, leaking one reference on every
probe.

The adapter device needs its firmware node while it is registered, so keep
the reference for as long as the adapter lives: register the release as a
devres action before the adapter is added, so that it runs after the
adapter has been removed.

While here, use device_set_node() so that dev.fwnode and dev.of_node point
to the same node.

Fixes: 63c5eb157cfd ("Input: pinephone-keyboard - support the proxied I2C bus")
Reported-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Closes: https://lore.kernel.org/all/aqwBtYAcIiwSSMmK@google.com/
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
 - Keep the firmware node reference for as long as the adapter device is
   registered and release it from a devres action, as suggested.
 - Apologies for the very late reply.

 drivers/input/keyboard/pinephone-keyboard.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/input/keyboard/pinephone-keyboard.c b/drivers/input/keyboard/pinephone-keyboard.c
index 86f21045c69b..b6a70e8a8a0b 100644
--- a/drivers/input/keyboard/pinephone-keyboard.c
+++ b/drivers/input/keyboard/pinephone-keyboard.c
@@ -317,13 +317,18 @@ static void ppkb_close(struct input_dev *input)
 	ppkb_set_scan(client, false);
 }
 
+static void ppkb_put_fwnode(void *data)
+{
+	fwnode_handle_put(data);
+}
+
 static int ppkb_probe(struct i2c_client *client)
 {
 	struct device *dev = &client->dev;
 	unsigned int phys_rows, phys_cols;
 	struct pinephone_keyboard *ppkb;
 	u8 info[PPKB_MATRIX_SIZE + 1];
-	struct device_node *i2c_bus;
+	struct fwnode_handle *fwnode;
 	int ret;
 	int error;
 
@@ -371,15 +376,20 @@ static int ppkb_probe(struct i2c_client *client)
 
 	i2c_set_clientdata(client, ppkb);
 
-	i2c_bus = of_get_child_by_name(dev->of_node, "i2c");
-	if (i2c_bus) {
+	fwnode = device_get_named_child_node(dev, "i2c");
+	if (fwnode) {
 		ppkb->adapter.owner = THIS_MODULE;
 		ppkb->adapter.algo = &ppkb_adap_algo;
 		ppkb->adapter.algo_data = client;
 		ppkb->adapter.dev.parent = dev;
-		ppkb->adapter.dev.of_node = i2c_bus;
 		strscpy(ppkb->adapter.name, DRV_NAME, sizeof(ppkb->adapter.name));
 
+		error = devm_add_action_or_reset(dev, ppkb_put_fwnode, fwnode);
+		if (error)
+			return error;
+
+		device_set_node(&ppkb->adapter.dev, fwnode);
+
 		error = devm_i2c_add_adapter(dev, &ppkb->adapter);
 		if (error) {
 			dev_err(dev, "Failed to add I2C adapter: %d\n", error);
-- 
2.25.1