Re: [PATCH 1/5] i3c: master: Release the fwnode of i2c boardinfo
Akhil R <[email protected]>
| Newsgroups | org.infradead.lists.linux-i3c,dev.linux.lists.sashiko-reviews |
|---|---|
| Message-ID | <[email protected]> |
On Wed, 5 Aug 2026 15:07:05 -0400, Frank Li wrote: > On Tue, Aug 04, 2026 at 10:33:05AM +0000, [email protected] wrote: ... >> [Severity: High] >> This is a pre-existing issue, but while fixing the leak for I2C devices, it >> looks like the identical leak was left behind in the I3C counterpart, >> i3c_master_add_i3c_boardinfo(). >> >> However, would applying the same devm_add_action_or_reset() fix there >> trigger a double-put use-after-free for instantiated I3C devices? >> >> Looking at how the I3C devices are created, i3c_master_register_new_i3c_devs() >> assigns the boardinfo fwnode to the new device without taking an additional >> reference: >> >> drivers/i3c/master.c:i3c_master_register_new_i3c_devs() { >> ... >> device_set_node(&desc->dev->dev, desc->boardinfo->fwnode); >> ... >> } >> >> And when the device is unregistered, i3c_device_release() unconditionally >> drops it: >> >> drivers/i3c/master.c:i3c_device_release() { >> ... >> fwnode_handle_put(dev->fwnode); >> ... >> } >> >> If a devm action is added to i3c_master_add_i3c_boardinfo() to drop the >> reference on teardown, wouldn't we also need to add a fwnode_handle_get() >> in i3c_master_register_new_i3c_devs() to ensure i3c_device_release() >> doesn't consume the reference the devm action expects to drop? > > Make sense, please make i2c/i3c handle fwnode consisent. Patch 2 of this series ("i3c: master: Fix refcount of i3c fwnode") does that. It adds the same devm action for the i3c boardinfo and takes a reference in i3c_master_register_new_i3c_devs(), so the put in i3c_device_release() is balanced and there is no double put. Best Regards, Akhil -- linux-i3c mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-i3c