Commit 7362a1553eb0 for kernel

commit 7362a1553eb09a8cdf8be7e509bd5309a8342486
Author: Liu Zhenlong <dragonliu2018@gmail.com>
Date:   Wed Aug 19 01:57:50 2026 +0800

    i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove()

    The of_node_put() matching of_node_get() runs after i2c_del_adapter(),
    whose trailing memset() zeroes adap->dev and thus adap->dev.of_node,
    making the put a no-op and leaking the node on every adapter removal
    and error cleanup.

    Use a devm action: the pointer is captured at registration, out of
    reach of that memset(), and devres runs the put once on probe failure
    and detach, replacing the three manual of_node_put() calls.  The
    setup loop uses the scoped iterator form so the child node is released
    automatically if devm_add_action_or_reset() fails mid-loop.

    Suggested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
    Fixes: 02a4a69667a2 ("i2c: qcom-cci: don't put a device tree node before i2c_add_adapter()")
    Assisted-by: Claude:claude-opus-5
    Signed-off-by: Liu Zhenlong <dragonliu2018@gmail.com>
    Cc: <stable@vger.kernel.org> # v5.17+
    Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
    Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
    Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
    Link: https://patch.msgid.link/20260818175750.4205-1-dragonliu2018@gmail.com

diff --git a/drivers/i2c/busses/i2c-qcom-cci.c b/drivers/i2c/busses/i2c-qcom-cci.c
index 25b6e4e9e3fa..873e901a23d7 100644
--- a/drivers/i2c/busses/i2c-qcom-cci.c
+++ b/drivers/i2c/busses/i2c-qcom-cci.c
@@ -497,10 +497,14 @@ static const struct dev_pm_ops qcom_cci_pm = {
 	SET_RUNTIME_PM_OPS(cci_suspend_runtime, cci_resume_runtime, NULL)
 };

+static void cci_put_of_node(void *data)
+{
+	of_node_put(data);
+}
+
 static int cci_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	struct device_node *child;
 	struct resource *r;
 	struct cci *cci;
 	int ret, i;
@@ -516,7 +520,7 @@ static int cci_probe(struct platform_device *pdev)
 	if (!cci->data)
 		return -ENOENT;

-	for_each_available_child_of_node(dev->of_node, child) {
+	for_each_available_child_of_node_scoped(dev->of_node, child) {
 		struct cci_master *master;
 		u32 idx;

@@ -537,6 +541,9 @@ static int cci_probe(struct platform_device *pdev)
 		master->adap.algo = &cci_algo;
 		master->adap.dev.parent = dev;
 		master->adap.dev.of_node = of_node_get(child);
+		ret = devm_add_action_or_reset(dev, cci_put_of_node, child);
+		if (ret)
+			return ret;
 		master->master = idx;
 		master->cci = cci;

@@ -606,10 +613,8 @@ static int cci_probe(struct platform_device *pdev)
 			continue;

 		ret = i2c_add_adapter(&cci->master[i].adap);
-		if (ret < 0) {
-			of_node_put(cci->master[i].adap.dev.of_node);
+		if (ret < 0)
 			goto error_i2c;
-		}
 	}

 	return 0;
@@ -617,10 +622,8 @@ static int cci_probe(struct platform_device *pdev)
 error_i2c:

 	for (--i ; i >= 0; i--) {
-		if (cci->master[i].cci) {
+		if (cci->master[i].cci)
 			i2c_del_adapter(&cci->master[i].adap);
-			of_node_put(cci->master[i].adap.dev.of_node);
-		}
 	}
 disable_clocks:
 	cci_disable_clocks(cci);
@@ -636,7 +639,6 @@ static void cci_remove(struct platform_device *pdev)
 	for (i = 0; i < cci->data->num_masters; i++) {
 		if (cci->master[i].cci) {
 			i2c_del_adapter(&cci->master[i].adap);
-			of_node_put(cci->master[i].adap.dev.of_node);
 			cci_halt(cci, i);
 		}
 	}