[PATCH v3 1/2] i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()

[Frank Li]

On Sat, Apr 04, 2026 at 06:32:30PM +0800, Felix Gu wrote:
> The dw_i3c_master_i3c_xfers() function allocates memory for the xfer
> structure using dw_i3c_master_alloc_xfer(). If pm_runtime_resume_and_get()
> fails, the function returns without freeing the allocated xfer, resulting
> in a memory leak.
>
> Since dw_i3c_master_free_xfer() is a thin wrapper around kfree(), use
> the __free(kfree) cleanup attribute to handle the free automatically on
> all exit paths.
>
> Fixes: 62fe9d06f570 ("i3c: dw: Add power management support")
> Signed-off-by: Felix Gu <ustc.gu at gmail.com>
> ---
Reviewed-by: Frank Li <Frank.Li at nxp.com>

>  drivers/i3c/master/dw-i3c-master.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
> index d6bdb32397fb..2e31228b3809 100644
> --- a/drivers/i3c/master/dw-i3c-master.c
> +++ b/drivers/i3c/master/dw-i3c-master.c
> @@ -7,6 +7,7 @@
>
>  #include <linux/bitfield.h>
>  #include <linux/bitops.h>
> +#include <linux/cleanup.h>
>  #include <linux/clk.h>
>  #include <linux/completion.h>
>  #include <linux/err.h>
> @@ -924,7 +925,6 @@ static int dw_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
>  	struct i3c_master_controller *m = i3c_dev_get_master(dev);
>  	struct dw_i3c_master *master = to_dw_i3c_master(m);
>  	unsigned int nrxwords = 0, ntxwords = 0;
> -	struct dw_i3c_xfer *xfer;
>  	int i, ret = 0;
>
>  	if (!i3c_nxfers)
> @@ -944,7 +944,7 @@ static int dw_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
>  	    nrxwords > master->caps.datafifodepth)
>  		return -EOPNOTSUPP;
>
> -	xfer = dw_i3c_master_alloc_xfer(master, i3c_nxfers);
> +	struct dw_i3c_xfer *xfer __free(kfree) = dw_i3c_master_alloc_xfer(master, i3c_nxfers);
>  	if (!xfer)
>  		return -ENOMEM;
>
> @@ -995,7 +995,6 @@ static int dw_i3c_master_i3c_xfers(struct i3c_dev_desc *dev,
>  	}
>
>  	ret = xfer->ret;
> -	dw_i3c_master_free_xfer(xfer);
>
>  	pm_runtime_put_autosuspend(master->dev);
>  	return ret;
>
> --
> 2.43.0
>