fsi_i2c_find_port_of_node() returns a referenced device_node for each
port. When an adapter is registered successfully, the node is stored in
port->adapter.dev.of_node and the reference remains held for the
lifetime of the port.

fsi_i2c_remove() deletes the adapter and frees the port, but does not
drop this device_node reference. As a result, each registered port
leaks a device_node reference when the driver is removed.

Save the node pointer before calling i2c_del_adapter(), since
i2c_del_adapter() clears the adapter device structure, and release the
reference with of_node_put() afterwards.

This issue was found by manual code inspection.

Fixes: 095561f476ab ("i2c: fsi: Create busses for all ports")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/i2c/busses/i2c-fsi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/i2c/busses/i2c-fsi.c b/drivers/i2c/busses/i2c-fsi.c
index b2dc5ae1d0e4..0c022e79ddbf 100644
--- a/drivers/i2c/busses/i2c-fsi.c
+++ b/drivers/i2c/busses/i2c-fsi.c
@@ -748,8 +748,11 @@ static void fsi_i2c_remove(struct fsi_device *fsi_dev)
 	struct fsi_i2c_port *port, *tmp;
 
 	list_for_each_entry_safe(port, tmp, &i2c->ports, list) {
+		struct device_node *np = port->adapter.dev.of_node;
+
 		list_del(&port->list);
 		i2c_del_adapter(&port->adapter);
+		of_node_put(np);
 		kfree(port);
 	}
 }
-- 
2.43.0