of_get_compatible_child() returns the child node with an incremented
reference which the caller must drop with of_node_put(). The error
paths release it via the out_put_node label, but the success path
returns without doing so, leaking the node reference.

Release the node before returning success.

Fixes: 897261149d25 ("i2c: of-prober: Add simple helpers for regulator support")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/i2c/i2c-core-of-prober.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/i2c-core-of-prober.c b/drivers/i2c/i2c-core-of-prober.c
index 6a82b03809d4..603de487ee2d 100644
--- a/drivers/i2c/i2c-core-of-prober.c
+++ b/drivers/i2c/i2c-core-of-prober.c
@@ -354,6 +354,7 @@ int i2c_of_probe_simple_enable(struct device *dev, struct device_node *bus_node,
 	if (ret)
 		goto out_disable_regulator;
 
+	of_node_put(node);
 	return 0;
 
 out_disable_regulator:
-- 
2.34.1

Hi,

On Wed, Sep 16, 2026 at 8:58 AM Wentao Liang <vulab@iscas.ac.cn> wrote:
>
> of_get_compatible_child() returns the child node with an incremented
> reference which the caller must drop with of_node_put(). The error
> paths release it via the out_put_node label, but the success path
> returns without doing so, leaking the node reference.
>
> Release the node before returning success.
>
> Fixes: 897261149d25 ("i2c: of-prober: Add simple helpers for regulator support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/i2c/i2c-core-of-prober.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/i2c/i2c-core-of-prober.c b/drivers/i2c/i2c-core-of-prober.c
> index 6a82b03809d4..603de487ee2d 100644
> --- a/drivers/i2c/i2c-core-of-prober.c
> +++ b/drivers/i2c/i2c-core-of-prober.c
> @@ -354,6 +354,7 @@ int i2c_of_probe_simple_enable(struct device *dev, struct device_node *bus_node,
>         if (ret)
>                 goto out_disable_regulator;
>
> +       of_node_put(node);
>         return 0;

Sure, looks fine. I guess alternatively we could use
'__free(device_node)' for cleanup, but it doesn't seem critical to me.

Reviewed-by: Douglas Anderson <dianders@chromium.org>