[PATCH] i3c: master: Fix of_node reference leak in i3c_master_register()

[PATCH] i3c: master: Fix of_node reference leak in i3c_master_register()

[Wentao Liang]

The reference taken on the parent's device node with of_node_get() is
normally dropped by i3c_masterdev_release() once the master device is
unregistered. When i3c_master_rpm_get() fails, the function returns
before device_initialize(), so put_device() is never called and the
node reference is leaked.

Release the device node reference on the runtime PM failure path.

Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/i3c/master.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 5cd4e5da2233..23f490a00591 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -3033,8 +3033,10 @@ int i3c_master_register(struct i3c_master_controller *master,
 	INIT_LIST_HEAD(&master->boardinfo.i3c);
 
 	ret = i3c_master_rpm_get(master);
-	if (ret)
+	if (ret) {
+		of_node_put(master->dev.of_node);
 		return ret;
+	}
 
 	device_initialize(&master->dev);
 
-- 
2.34.1


-- 
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c

Re: [PATCH] i3c: master: Fix of_node reference leak in i3c_master_register()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] i3c: API mismatch in error path leaves fwnode reference leaked on ACPI
--

commit b1e59a31437144668b1fb151fcdcb4359e796610
Author: Wentao Liang <vulab@iscas.ac.cn>

i3c: master: Fix of_node reference leak in i3c_master_register()

This commit attempts to fix a node reference leak in the error path of
i3c_master_register() when i3c_master_rpm_get() fails. It drops the reference
before device_initialize() is called.

> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index afcd7a21a3e66..1909d40387879 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
> @@ -3685,8 +3685,10 @@ int i3c_master_register(struct i3c_master_controller *master,
>  	INIT_LIST_HEAD(&master->boardinfo.i3c);
>  
>  	ret = i3c_master_rpm_get(master);
> -	if (ret)
> +	if (ret) {
> +		of_node_put(master->dev.of_node);

[Severity: Medium]
Does this code correctly release the fwnode reference on non-DT systems like
ACPI?

The node for master->dev is acquired earlier in i3c_master_register() 
using the generic fwnode API:

	device_set_node(&master->dev, fwnode_handle_get(dev_fwnode(parent)));

Since of_node_put() only operates on Open Firmware nodes, won't this result in
a leaked reference on platforms utilizing ACPI or software nodes?

Should this use fwnode_handle_put(dev_fwnode(&master->dev)) instead, matching
the cleanup sequence implemented in i3c_masterdev_release()?

>  		return ret;
> +	}
>  
>  	device_initialize(&master->dev);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916160358.2081087-1-vulab@iscas.ac.cn?part=1

-- 
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c

Re: [PATCH] i3c: master: Fix of_node reference leak in i3c_master_register()

[Frank Li]

On Wed, Sep 16, 2026 at 04:16:15PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] i3c: API mismatch in error path leaves fwnode reference leaked on ACPI
> --
>
> commit b1e59a31437144668b1fb151fcdcb4359e796610
> Author: Wentao Liang <vulab@iscas.ac.cn>
>
> i3c: master: Fix of_node reference leak in i3c_master_register()
>
> This commit attempts to fix a node reference leak in the error path of
> i3c_master_register() when i3c_master_rpm_get() fails. It drops the reference
> before device_initialize() is called.
>
> > diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> > index afcd7a21a3e66..1909d40387879 100644
> > --- a/drivers/i3c/master.c
> > +++ b/drivers/i3c/master.c
> > @@ -3685,8 +3685,10 @@ int i3c_master_register(struct i3c_master_controller *master,
> >  	INIT_LIST_HEAD(&master->boardinfo.i3c);
> >
> >  	ret = i3c_master_rpm_get(master);
> > -	if (ret)
> > +	if (ret) {
> > +		of_node_put(master->dev.of_node);
>
> [Severity: Medium]
> Does this code correctly release the fwnode reference on non-DT systems like
> ACPI?
>
> The node for master->dev is acquired earlier in i3c_master_register()
> using the generic fwnode API:
>
> 	device_set_node(&master->dev, fwnode_handle_get(dev_fwnode(parent)));
>
> Since of_node_put() only operates on Open Firmware nodes, won't this result in
> a leaked reference on platforms utilizing ACPI or software nodes?
>
> Should this use fwnode_handle_put(dev_fwnode(&master->dev)) instead, matching
> the cleanup sequence implemented in i3c_masterdev_release()?

Beside this, why other error branch in this function needn't call
fwnode_handle_put()

Frank
>
> >  		return ret;
> > +	}
> >
> >  	device_initialize(&master->dev);
> >
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20260916160358.2081087-1-vulab@iscas.ac.cn?part=1
>
> --
> linux-i3c mailing list
> linux-i3c@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-i3c

-- 
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c