[PATCH v2] i3c: master: Fix fwnode reference leak in i3c_master_register_fwnode()

[PATCH v2] i3c: master: Fix fwnode reference leak in i3c_master_register_fwnode()

[Wentao Liang]

i3c_master_register_fwnode() takes a reference on the bus firmware node
with fwnode_handle_get() and stores it in master->dev. That reference is
normally dropped by i3c_masterdev_release(), which runs when the last
reference on the master device is put.

If i3c_master_rpm_get() fails, the function returns before
device_initialize(), so put_device() is never called, the release
callback never runs, and the reference is leaked.

Release the reference explicitly on that path. of_node_put() is not
enough here: it only acts on Open Firmware nodes, so the reference would
still leak on ACPI and software node systems.

The candidate was found with static analysis tools; DeepSeek and GPT-6.1
Sol were used to audit it and to help prepare this fix.

Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
- Sorry for the delay. v1 used of_node_put() on a reference taken with
  fwnode_handle_get(), which Frank pointed out.
- Use fwnode_handle_put(dev_fwnode(&master->dev)) instead.
- Rebased on current mainline (fa4ad798f6f6), where this code lives in
  i3c_master_register_fwnode().
- Dropped Cc: stable@vger.kernel.org. This only leaks when the runtime PM
  resume fails during registration, so I leave the backport decision to
  you.
- Build-tested with an x86_64 defconfig, including W=1: drivers/i3c/
  compiles without warnings and checkpatch.pl is clean. I could not make
  i3c_master_rpm_get() fail at runtime, so the failing path itself was not
  exercised on hardware.
- Link to v1: https://lore.kernel.org/all/20260916160358.2081087-1-vulab@iscas.ac.cn/

 drivers/i3c/master.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 01e05bad8661..c532693f8463 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -3897,8 +3897,10 @@ int i3c_master_register_fwnode(struct i3c_master_controller *master,
 	INIT_LIST_HEAD(&master->boardinfo.i3c);
 
 	ret = i3c_master_rpm_get(master);
-	if (ret)
+	if (ret) {
+		fwnode_handle_put(dev_fwnode(&master->dev));
 		return ret;
+	}
 
 	device_initialize(&master->dev);
 
-- 
2.34.1