[PATCH] i3c: master: Fix of_node reference leak in of_i3c_master_add_i2c_boardinfo()

[Wentao Liang]

of_i2c_get_board_info() stores the device node in the board info's fwnode
without taking a reference, so the board info relies on the trailing
of_node_get() to keep the node alive. Nothing ever drops that reference:
the board info is devres-allocated and has no release callback.

Register the reference as a device-managed action of the I3C master so it
is released on registration failure and on controller teardown.

Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable at vger.kernel.org
Signed-off-by: Wentao Liang <vulab at iscas.ac.cn>
---
 drivers/i3c/master.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 23f490a00591..30b3822c530c 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -2407,6 +2407,11 @@ EXPORT_SYMBOL_GPL(i3c_master_add_i3c_dev_locked);
 
 #define OF_I3C_REG1_IS_I2C_DEV			BIT(31)
 
+static void of_i3c_master_put_node(void *data)
+{
+	of_node_put(data);
+}
+
 static int
 of_i3c_master_add_i2c_boardinfo(struct i3c_master_controller *master,
 				struct device_node *node, u32 *reg)
@@ -2437,9 +2442,9 @@ of_i3c_master_add_i2c_boardinfo(struct i3c_master_controller *master,
 	boardinfo->lvr = reg[2];
 
 	list_add_tail(&boardinfo->node, &master->boardinfo.i2c);
-	of_node_get(node);
 
-	return 0;
+	return devm_add_action_or_reset(dev, of_i3c_master_put_node,
+					of_node_get(node));
 }
 
 static int
-- 
2.34.1