[PATCH] i3c: master: Fix of_node reference leak in i3c_master_register()

[PATCH] i3c: master: Fix of_node reference leak in i3c_master_register()

[Wentao Liang]

The reference taken on the parent's device node with of_node_get() is
normally dropped by i3c_masterdev_release() once the master device is
unregistered. When i3c_master_rpm_get() fails, the function returns
before device_initialize(), so put_device() is never called and the
node reference is leaked.

Release the device node reference on the runtime PM failure path.

Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/i3c/master.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 5cd4e5da2233..23f490a00591 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -3033,8 +3033,10 @@ int i3c_master_register(struct i3c_master_controller *master,
 	INIT_LIST_HEAD(&master->boardinfo.i3c);
 
 	ret = i3c_master_rpm_get(master);
-	if (ret)
+	if (ret) {
+		of_node_put(master->dev.of_node);
 		return ret;
+	}
 
 	device_initialize(&master->dev);
 
-- 
2.34.1

Re: [PATCH] i3c: master: Fix of_node reference leak in i3c_master_register()

[Wentao Liang]

Hi Frank,

Sorry for the very late reply.

Thank you for catching both problems. You are right, and I am sorry for
getting the API wrong in v1: the reference on the node is taken with
fwnode_handle_get(), so it has to be dropped with fwnode_handle_put().
of_node_put() only operates on Open Firmware nodes and is a no-op on ACPI
and software node systems, so the leak remained there.

On your second question: every other error branch in this function runs
after device_initialize(), and all of them end up at err_put_dev, where
put_device() calls i3c_masterdev_release() and that function drops the
fwnode with fwnode_handle_put(dev->fwnode). The i3c_master_rpm_get()
failure is the only path that returns before the device is initialized;
put_device() cannot be used there, so the reference has to be dropped
explicitly.

A v2 that calls fwnode_handle_put(dev_fwnode(&master->dev)), rebased on
current mainline, follows in a separate mail. I also dropped Cc: stable
there, since this only leaks on a registration failure path.

Thanks,
Wentao