From 4eb422482ca5d924d7212ad2ca1cb7ea6f5b524d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicol=C3=A1s=20Antinori?= Date: Sun, 31 May 2026 15:23:07 -0300 Subject: [PATCH] rust: i2c: fix I2cAdapter refcounts double increment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When `I2cAdapter::get` executes, it first calls `bindings::i2c_get_adapter()` which increments the device and module reference counts. It then takes a reference to the raw pointer and converts it to an `ARef` via `.into()`. The implementation of `From<&T> for ARef` where `T: AlwaysRefCounted` unconditionally calls `T::inc_ref()`. This leads to a second increment to the reference counts. Since the returned `ARef` will only release a single reference when dropped via `dec_ref()`, this leaks one device and module reference count on every call. This fix was suggested by sashiko.dev. Link: https://sashiko.dev/#/patchset/20260521190937.248904-1-nico.antinori.7@gmail.com Signed-off-by: Nicolás Antinori Reviewed-by: Igor Korotin Signed-off-by: Igor Korotin --- rust/kernel/i2c.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/rust/kernel/i2c.rs b/rust/kernel/i2c.rs index 7b908f0c5a58..c084a45b1916 100644 --- a/rust/kernel/i2c.rs +++ b/rust/kernel/i2c.rs @@ -405,7 +405,9 @@ impl I2cAdapter { // SAFETY: `adapter` is non-null and points to a live `i2c_adapter`. // `I2cAdapter` is #[repr(transparent)], so this cast is valid. - Ok(unsafe { (&*adapter.as_ptr().cast::>()).into() }) + // `i2c_get_adapter` returned the adapter with an incremented refcount, which we pass to + // the `ARef`. + Ok(unsafe { ARef::from_raw(adapter.cast::>()) }) } }