[PATCH v2] i2c: rust: fix I2cAdapter refcounts double increment
From: Nicolás Antinori
Date: Tue May 26 2026 - 15:47:57 EST
When `I2cAdapter::get` executes, it first calls
`bindings::i2c_get_adapter()` which increments the device and module
reference counts. It then takes a reference to the raw pointer and
converts it to an `ARef` via `.into()`.
The implementation of `From<&T> for ARef<T>` where `T: AlwaysRefCounted`
unconditionally calls `T::inc_ref()`. This leads to a second call to
`bindings::i2c_get_adapter()` inside `I2cAdapter::inc_ref()`.
Since the returned `ARef` will only release a single reference when
dropped via `dec_ref()`, this leaks one device and module reference count
on every call.
This fix was suggested by sashiko.dev.
Link: https://sashiko.dev/#/patchset/20260521190937.248904-1-nico.antinori.7@xxxxxxxxx
Signed-off-by: Nicolás Antinori <nico.antinori.7@xxxxxxxxx>
---
Changelog:
v2: add missing Link tag to commit message
v1: https://lore.kernel.org/rust-for-linux/20260524181151.24988-1-nico.antinori.7@xxxxxxxxx
rust/kernel/i2c.rs | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/rust/kernel/i2c.rs b/rust/kernel/i2c.rs
index 7b908f0c5a58..ca6476cf4399 100644
--- a/rust/kernel/i2c.rs
+++ b/rust/kernel/i2c.rs
@@ -405,7 +405,11 @@ pub fn get(index: i32) -> Result<ARef<Self>> {
// SAFETY: `adapter` is non-null and points to a live `i2c_adapter`.
// `I2cAdapter` is #[repr(transparent)], so this cast is valid.
- Ok(unsafe { (&*adapter.as_ptr().cast::<I2cAdapter<device::Normal>>()).into() })
+ Ok(unsafe {
+ ARef::from_raw(NonNull::new_unchecked(
+ adapter.as_ptr().cast::<I2cAdapter<device::Normal>>(),
+ ))
+ })
}
}
--
2.53.0