The device node reference returned by of_get_child_by_name() is
stored as the adapter's of_node but never released, leaking one node
reference on every probe, successful or not.

The adapter only borrows the node, so drop the reference once the
adapter has been added, and also on the error path.

Fixes: 63c5eb157cfd ("Input: pinephone-keyboard - support the proxied I2C bus")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/input/keyboard/pinephone-keyboard.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/input/keyboard/pinephone-keyboard.c b/drivers/input/keyboard/pinephone-keyboard.c
index 147b1f288a33..c82323713be8 100644
--- a/drivers/input/keyboard/pinephone-keyboard.c
+++ b/drivers/input/keyboard/pinephone-keyboard.c
@@ -384,8 +384,10 @@ static int ppkb_probe(struct i2c_client *client)
 		error = devm_i2c_add_adapter(dev, &ppkb->adapter);
 		if (error) {
 			dev_err(dev, "Failed to add I2C adapter: %d\n", error);
+			of_node_put(i2c_bus);
 			return error;
 		}
+		of_node_put(i2c_bus);
 	}
 
 	crc8_populate_msb(ppkb->crc_table, PPKB_CRC8_POLYNOMIAL);
-- 
2.34.1

Hi Wentao,

On Wed, Sep 16, 2026 at 06:47:21PM +0000, Wentao Liang wrote:
> The device node reference returned by of_get_child_by_name() is
> stored as the adapter's of_node but never released, leaking one node
> reference on every probe, successful or not.
> 
> The adapter only borrows the node, so drop the reference once the
> adapter has been added, and also on the error path.

I do not think this is correct fix. The node assigned to the adapter
should stay alive while the adapter is alive.

I think we should convert of_node to fwnode, use device_set_node() to
make sure both fwnode and of_node are pointing to the same thing, and
set up devm_add_action_or_reset() to free the fwnode at the right time. 

Thanks.

-- 
Dmitry