Re: [PATCH v2] i3c: master: Fix fwnode reference leak in i3c_master_register_fwnode()

[Frank Li <Frank.li@oss.nxp.com>]

On Sun, Nov 08, 2026 at 09:29:20AM +0000, Wentao Liang wrote:
> i3c_master_register_fwnode() takes a reference on the bus firmware node
> with fwnode_handle_get() and stores it in master->dev. That reference is
> normally dropped by i3c_masterdev_release(), which runs when the last
> reference on the master device is put.
>
> If i3c_master_rpm_get() fails, the function returns before
> device_initialize(), so put_device() is never called, the release
> callback never runs, and the reference is leaked.
>
> Release the reference explicitly on that path. of_node_put() is not
> enough here: it only acts on Open Firmware nodes, so the reference would
> still leak on ACPI and software node systems.
>
> The candidate was found with static analysis tools; DeepSeek and GPT-6.1
> Sol were used to audit it and to help prepare this fix.
>
> Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
> Changes in v2:
> - Sorry for the delay. v1 used of_node_put() on a reference taken with
>   fwnode_handle_get(), which Frank pointed out.
> - Use fwnode_handle_put(dev_fwnode(&master->dev)) instead.
> - Rebased on current mainline (fa4ad798f6f6), where this code lives in
>   i3c_master_register_fwnode().
> - Dropped Cc: stable@vger.kernel.org. This only leaks when the runtime PM
>   resume fails during registration, so I leave the backport decision to
>   you.
> - Build-tested with an x86_64 defconfig, including W=1: drivers/i3c/
>   compiles without warnings and checkpatch.pl is clean. I could not make
>   i3c_master_rpm_get() fail at runtime, so the failing path itself was not
>   exercised on hardware.
> - Link to v1: https://lore.kernel.org/all/20260916160358.2081087-1-vulab@iscas.ac.cn/
>
>  drivers/i3c/master.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index 01e05bad8661..c532693f8463 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
> @@ -3897,8 +3897,10 @@ int i3c_master_register_fwnode(struct i3c_master_controller *master,
>  	INIT_LIST_HEAD(&master->boardinfo.i3c);
>
>  	ret = i3c_master_rpm_get(master);
> -	if (ret)
> +	if (ret) {
> +		fwnode_handle_put(dev_fwnode(&master->dev));

direct use parameter fwnode

Frank
>  		return ret;
> +	}
>
>  	device_initialize(&master->dev);
>
> --
> 2.34.1
>