[PATCH V2 2/8] i3c: master: Support IBI-based wakeup capability

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `of_node_get()` when assigning `boardinfo->of_node` to the device, causing reference count corruption when the device is released.
--

--- Patch [2]: [PATCH V2 2/8] i3c: master: Support IBI-based wakeup capability ---
commit a4a974dcadbb70afc57836a361635db60b65ebde
Author: Adrian Hunter <adrian.hunter at intel.com>

i3c: master: Support IBI-based wakeup capability

This commit adds an ibi_wakeup flag to struct i3c_master_controller to
allow controller drivers to advertise support for IBI-based wakeup. It also
marks IBI-capable I3C devices as wakeup capable during registration.

> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index 874f6e11b296d..cf3345265ac0b 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
> @@ -2008,6 +2008,13 @@ i3c_master_register_new_i3c_devs(struct i3c_master_controller *master)
>  		if (desc->boardinfo)
>  			desc->dev->dev.of_node = desc->boardinfo->of_node;

[Severity: High]
This is a pre-existing issue, but does this assignment miss an
of_node_get()?

It looks like boardinfo->of_node holds a reference count acquired in
of_i3c_master_add_i3c_boardinfo():

    boardinfo->of_node = of_node_get(node);

However, when this pointer is copied to desc->dev->dev.of_node here, the
reference count is not incremented. Later, when the device is released,
i3c_device_release() unconditionally drops a reference:

    of_node_put(i3cdev->dev.of_node);

If the device registration fails or if it is later unregistered (e.g., due
to a hot-remove event), this would drain the reference conceptually owned
by boardinfo. 

If the device is then recreated during a subsequent hot-join, could
boardinfo reassign the now-freed of_node pointer and cause a use-after-free
and double-free on the next release?

>  
> +		/*
> +		 * In the case of IBI wakeup, any IBI-capable device can
> +		 * wakeup.
> +		 */
> +		if (master->ibi_wakeup && (desc->info.bcr & I3C_BCR_IBI_REQ_CAP))
> +			device_set_wakeup_capable(&desc->dev->dev, true);
> +
>  		list_add_tail(&desc->dev->node, &i3c_unreg_devs);
>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260728155308.142713-1-adrian.hunter@intel.com?part=2