Re: [PATCH] i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

[Andi Shyti]

Hi Ma,

On Mon, Oct 12, 2026 at 09:34:21AM +0800, Ma Ke wrote:
> i2c_acpi_new_device_by_fwnode() obtains an i2c_adapter through
> i2c_acpi_find_adapter_by_handle(). That helper uses bus_find_device()
> internally, so it returns the adapter with a reference held:
> 
>         adapter = i2c_verify_adapter(dev);
>         if (!adapter)
>                 put_device(dev);
> 
>         return adapter;
> 
> The reference is only put on the failure path inside that helper. The
> caller owns it otherwise. i2c_acpi_new_device_by_fwnode() never drops
> it, neither on the -EPROBE_DEFER path nor after
> i2c_new_client_device(), so every call leaks one reference on the
> adapter and the adapter can never be released.
> 
> i2c_new_client_device() does not consume that reference. It registers
> the new client with the adapter as its parent, and device_add() takes
> its own reference on the parent, which device_del() releases when the
> client goes away.  The reference obtained by the lookup is a separate
> one and has to be dropped here.

actually device_del() can even end up looping indefinitely
waiting for the reference to drop to 0.

> i2c_acpi_notify() in the same file already does exactly this. It takes
> the adapter from the same helper, registers the client through
> i2c_acpi_register_device(), which calls i2c_new_client_device(), and
> then puts the reference.
> 
> i2c_new_client_device() gives the client its own reference on the
> adapter, so ours can be dropped unconditionally.
> 
> Found by code review.
> 
> Fixes: 605f8fc22442 ("i2c: core: Add new i2c_acpi_new_device helper function")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ma Ke <make_ruc2021@xxxxxxx>

Pushed to i2c/i2c-2.

Thanks,
Andi