[PATCH] i3c: master: Fix of_node reference leak in of_i3c_master_add_i2c_boardinfo()

[PATCH] i3c: master: Fix of_node reference leak in of_i3c_master_add_i2c_boardinfo()

[Wentao Liang]

of_i2c_get_board_info() stores the device node in the board info's fwnode
without taking a reference, so the board info relies on the trailing
of_node_get() to keep the node alive. Nothing ever drops that reference:
the board info is devres-allocated and has no release callback.

Register the reference as a device-managed action of the I3C master so it
is released on registration failure and on controller teardown.

Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/i3c/master.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 23f490a00591..30b3822c530c 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -2407,6 +2407,11 @@ EXPORT_SYMBOL_GPL(i3c_master_add_i3c_dev_locked);
 
 #define OF_I3C_REG1_IS_I2C_DEV			BIT(31)
 
+static void of_i3c_master_put_node(void *data)
+{
+	of_node_put(data);
+}
+
 static int
 of_i3c_master_add_i2c_boardinfo(struct i3c_master_controller *master,
 				struct device_node *node, u32 *reg)
@@ -2437,9 +2442,9 @@ of_i3c_master_add_i2c_boardinfo(struct i3c_master_controller *master,
 	boardinfo->lvr = reg[2];
 
 	list_add_tail(&boardinfo->node, &master->boardinfo.i2c);
-	of_node_get(node);
 
-	return 0;
+	return devm_add_action_or_reset(dev, of_i3c_master_put_node,
+					of_node_get(node));
 }
 
 static int
-- 
2.34.1

Re: [PATCH] i3c: master: Fix of_node reference leak in of_i3c_master_add_i2c_boardinfo()

[Frank Li]

On Wed, Sep 16, 2026 at 04:06:54PM +0000, Wentao Liang wrote:
> of_i2c_get_board_info() stores the device node in the board info's fwnode
> without taking a reference, so the board info relies on the trailing
> of_node_get() to keep the node alive. Nothing ever drops that reference:
> the board info is devres-allocated and has no release callback.
>
> Register the reference as a device-managed action of the I3C master so it
> is released on registration failure and on controller teardown.
>
> Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/i3c/master.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index 23f490a00591..30b3822c530c 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
> @@ -2407,6 +2407,11 @@ EXPORT_SYMBOL_GPL(i3c_master_add_i3c_dev_locked);
>
>  #define OF_I3C_REG1_IS_I2C_DEV			BIT(31)
>
> +static void of_i3c_master_put_node(void *data)
> +{
> +	of_node_put(data);
> +}
> +
>  static int
>  of_i3c_master_add_i2c_boardinfo(struct i3c_master_controller *master,
>  				struct device_node *node, u32 *reg)

which code base do you use, now use of_i2c_get_board_info()

Frank
> @@ -2437,9 +2442,9 @@ of_i3c_master_add_i2c_boardinfo(struct i3c_master_controller *master,
>  	boardinfo->lvr = reg[2];
>
>  	list_add_tail(&boardinfo->node, &master->boardinfo.i2c);
> -	of_node_get(node);
>
> -	return 0;
> +	return devm_add_action_or_reset(dev, of_i3c_master_put_node,
> +					of_node_get(node));
>  }
>
>  static int
> --
> 2.34.1
>