fsi_i2c_find_port_of_node() returns a referenced device_node for each port. When an adapter is registered successfully, the node is stored in port->adapter.dev.of_node and the reference remains held for the lifetime of the port. fsi_i2c_remove() deletes the adapter and frees the port, but does not drop this device_node reference. As a result, each registered port leaks a device_node reference when the driver is removed. Save the node pointer before calling i2c_del_adapter(), since i2c_del_adapter() clears the adapter device structure, and release the reference with of_node_put() afterwards. This issue was found by manual code inspection. Fixes: 095561f476ab ("i2c: fsi: Create busses for all ports") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/i2c/busses/i2c-fsi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/i2c/busses/i2c-fsi.c b/drivers/i2c/busses/i2c-fsi.c index b2dc5ae1d0e4..0c022e79ddbf 100644 --- a/drivers/i2c/busses/i2c-fsi.c +++ b/drivers/i2c/busses/i2c-fsi.c @@ -748,8 +748,11 @@ static void fsi_i2c_remove(struct fsi_device *fsi_dev) struct fsi_i2c_port *port, *tmp; list_for_each_entry_safe(port, tmp, &i2c->ports, list) { + struct device_node *np = port->adapter.dev.of_node; + list_del(&port->list); i2c_del_adapter(&port->adapter); + of_node_put(np); kfree(port); } } -- 2.43.0