[PATCH] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

[PATCH] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

[Wentao Liang]

i2c_acpi_find_adapter_by_handle() returns the adapter with a reference
obtained via get_device() in bus_find_device(), which the caller is
responsible for dropping. i2c_new_client_device() stores the adapter
pointer without taking a reference and does not release the caller's
reference on any path, so the reference is leaked.

Drop the adapter device reference after creating the client, like
i2c_acpi_notify() does.

Fixes: 53f8f7c5cf14 ("i2c: break out ACPI support into separate file")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/i2c/i2c-core-acpi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index 28c0e4884a7f..5efd1c406bc2 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -544,6 +544,7 @@ struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,
 						 struct i2c_board_info *info)
 {
 	struct i2c_acpi_lookup lookup;
+	struct i2c_client *client;
 	struct i2c_adapter *adapter;
 	struct acpi_device *adev;
 	LIST_HEAD(resource_list);
@@ -572,7 +573,10 @@ struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,
 	if (!adapter)
 		return ERR_PTR(-EPROBE_DEFER);
 
-	return i2c_new_client_device(adapter, info);
+	client = i2c_new_client_device(adapter, info);
+	put_device(&adapter->dev);
+
+	return client;
 }
 EXPORT_SYMBOL_GPL(i2c_acpi_new_device_by_fwnode);
 
-- 
2.34.1

Re: [PATCH] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

[Mika Westerberg]

Hi,

On Wed, Sep 16, 2026 at 03:55:07PM +0000, Wentao Liang wrote:
> i2c_acpi_find_adapter_by_handle() returns the adapter with a reference
> obtained via get_device() in bus_find_device(), which the caller is
> responsible for dropping. i2c_new_client_device() stores the adapter
> pointer without taking a reference and does not release the caller's
> reference on any path, so the reference is leaked.
> 
> Drop the adapter device reference after creating the client, like
> i2c_acpi_notify() does.
> 
> Fixes: 53f8f7c5cf14 ("i2c: break out ACPI support into separate file")

I don't think this is right. The issue existed already before the move.

> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Acked-by: Mika Westerberg <westeri@kernel.org>

[PATCH] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

[Ma Ke]

i2c_acpi_new_device_by_fwnode() obtains an i2c_adapter through
i2c_acpi_find_adapter_by_handle(). That helper uses bus_find_device()
internally, so it returns the adapter with a reference held:

        adapter = i2c_verify_adapter(dev);
        if (!adapter)
                put_device(dev);

        return adapter;

The reference is only put on the failure path inside that helper. The
caller owns it otherwise. i2c_acpi_new_device_by_fwnode() never drops
it, neither on the -EPROBE_DEFER path nor after
i2c_new_client_device(), so every call leaks one reference on the
adapter and the adapter can never be released.

i2c_new_client_device() does not consume that reference. It registers
the new client with the adapter as its parent, and device_add() takes
its own reference on the parent, which device_del() releases when the
client goes away.  The reference obtained by the lookup is a separate
one and has to be dropped here.

i2c_acpi_notify() in the same file already does exactly this. It takes
the adapter from the same helper, registers the client through
i2c_acpi_register_device(), which calls i2c_new_client_device(), and
then puts the reference.

i2c_new_client_device() gives the client its own reference on the
adapter, so ours can be dropped unconditionally.

Found by code review.

Fixes: 605f8fc22442 ("i2c: core: Add new i2c_acpi_new_device helper function")
Cc: stable@vger.kernel.org
Signed-off-by: Ma Ke <make_ruc2021@163.com>
---
 drivers/i2c/i2c-core-acpi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index 8f3bdd50186e..37d1309e93b5 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -547,6 +547,7 @@ struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,
 {
 	struct i2c_acpi_lookup lookup;
 	struct i2c_adapter *adapter;
+	struct i2c_client *client;
 	struct acpi_device *adev;
 	LIST_HEAD(resource_list);
 	int ret;
@@ -574,7 +575,10 @@ struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,
 	if (!adapter)
 		return ERR_PTR(-EPROBE_DEFER);
 
-	return i2c_new_client_device(adapter, info);
+	client = i2c_new_client_device(adapter, info);
+	put_device(&adapter->dev);
+
+	return client;
 }
 EXPORT_SYMBOL_GPL(i2c_acpi_new_device_by_fwnode);
 
-- 
2.43.0