The codec device reference taken by of_find_i2c_device_by_node() is kept
in codec_dev[] and never released, leaking the I2C client on both the
error paths and the successful registration path. The same slot also
holds the reference of_find_device_by_node() takes when the codec is a
platform device, which leaks in the same way.

Drop those references on the shared exit path.

Fixes: 708b4351f08c ("ASoC: fsl: Add Freescale Generic ASoC Sound Card with ASRC support")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 sound/soc/fsl/fsl-asoc-card.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c
index 3fdc77d5968b..04adb8e76e29 100644
--- a/sound/soc/fsl/fsl-asoc-card.c
+++ b/sound/soc/fsl/fsl-asoc-card.c
@@ -1069,6 +1069,8 @@ static int fsl_asoc_card_probe(struct platform_device *pdev)
 	of_node_put(asrc_np);
 	of_node_put(codec_np[0]);
 	of_node_put(codec_np[1]);
+	for (codec_idx = 0; codec_idx < 2; codec_idx++)
+		put_device(codec_dev[codec_idx]);
 	if (asrc_pdev)
 		put_device(&asrc_pdev->dev);
 	put_device(&cpu_pdev->dev);
-- 
2.34.1

On Thu, Sep 17, 2026 at 04:56:54PM +0000, Wentao Liang wrote:
> The codec device reference taken by of_find_i2c_device_by_node() is kept
> in codec_dev[] and never released, leaking the I2C client on both the
> error paths and the successful registration path. The same slot also
> holds the reference of_find_device_by_node() takes when the codec is a
> platform device, which leaks in the same way.

This doesn't apply against current code, please check and resend.