[PATCH 1/5] i3c: master: Release the fwnode of i2c boardinfo

[Akhil R]

On Wed, 5 Aug 2026 15:07:05 -0400, Frank Li wrote:
> On Tue, Aug 04, 2026 at 10:33:05AM +0000, sashiko-bot at kernel.org wrote:

...

>> [Severity: High]
>> This is a pre-existing issue, but while fixing the leak for I2C devices, it
>> looks like the identical leak was left behind in the I3C counterpart,
>> i3c_master_add_i3c_boardinfo().
>>
>> However, would applying the same devm_add_action_or_reset() fix there
>> trigger a double-put use-after-free for instantiated I3C devices?
>>
>> Looking at how the I3C devices are created, i3c_master_register_new_i3c_devs()
>> assigns the boardinfo fwnode to the new device without taking an additional
>> reference:
>>
>> drivers/i3c/master.c:i3c_master_register_new_i3c_devs() {
>>     ...
>>     device_set_node(&desc->dev->dev, desc->boardinfo->fwnode);
>>     ...
>> }
>>
>> And when the device is unregistered, i3c_device_release() unconditionally
>> drops it:
>>
>> drivers/i3c/master.c:i3c_device_release() {
>>     ...
>>     fwnode_handle_put(dev->fwnode);
>>     ...
>> }
>>
>> If a devm action is added to i3c_master_add_i3c_boardinfo() to drop the
>> reference on teardown, wouldn't we also need to add a fwnode_handle_get()
>> in i3c_master_register_new_i3c_devs() to ensure i3c_device_release()
>> doesn't consume the reference the devm action expects to drop?
> 
> Make sense, please make i2c/i3c handle fwnode consisent.

Patch 2 of this series ("i3c: master: Fix refcount of i3c fwnode") does
that. It adds the same devm action for the i3c boardinfo and takes a
reference in i3c_master_register_new_i3c_devs(), so the put in
i3c_device_release() is balanced and there is no double put.

Best Regards,
Akhil