This series fixes device_node refcount leaks in 5 i2c bus drivers that
share the same bug pattern:
adap->dev.of_node = of_node_get(pdev->dev.of_node);
Each driver calls of_node_get() to take an extra reference on the
platform device's of_node when assigning it to the adapter device, but
none of them drop it in the probe error paths nor in the remove()
callback.
device_release() does not call of_node_put(), and
i2c_adapter_dev_release() only completes a struct, so the extra
reference is never released, leaking the device_node on every probe
failure and every adapter removal.
Additionally, in the remove() callbacks, i2c_del_adapter() clears
adap->dev with memset() at the end (commit bd4bc3dbded9 ("i2c: Clear
i2c_adapter.dev on adapter removal")), which zeroes adap->dev.of_node
before of_node_put() runs, turning it into a no-op. The fix caches the
pointer before calling i2c_del_adapter(), the same approach used in
i2c-mux (i2c_mux_del_adapters) and mtd (commit 56570bdad5e3 ("mtd: core:
Fix refcount error in del_mtd_device()")).
A related fix for the i2c-qcom-cci driver has already been submitted
separately:
https://lore.kernel.org/linux-i2c/[email protected]/
These 5 drivers are the remaining i2c bus drivers that use of_node_get()
on the adapter device; all other drivers either assign of_node directly
(without taking an extra reference) or don't use Device Tree at all.
Each patch has its own Fixes: tag pointing to the commit that introduced
of_node_get() in the respective driver, and requests stable backport via
Cc: [email protected].
Compile-tested with gcc on arm64 defconfig using COMPILE_TEST; no
hardware available for runtime testing.
Liu Zhenlong (5):
i2c: mpc: fix device_node refcount leak in fsl_i2c_probe()/fsl_i2c_remove()
i2c: cpm: fix device_node refcount leak in cpm_i2c_probe()/cpm_i2c_remove()
i2c: ibm_iic: fix device_node refcount leak in iic_probe()/iic_remove()
i2c: opal: fix device_node refcount leak in i2c_opal_probe/remove()
i2c: pnx: fix device_node refcount leak in i2c_pnx_probe()/i2c_pnx_remove()
drivers/i2c/busses/i2c-cpm.c | 3 +++
drivers/i2c/busses/i2c-ibm_iic.c | 4 ++++
drivers/i2c/busses/i2c-mpc.c | 6 +++++-
drivers/i2c/busses/i2c-opal.c | 6 +++++-
drivers/i2c/busses/i2c-pnx.c | 15 ++++++++++++---
5 files changed, 29 insertions(+), 5 deletions(-)
--
2.55.0
