diff options
| author | Adrian Hunter <adrian.hunter@intel.com> | 2026-07-02 21:36:44 +0300 |
|---|---|---|
| committer | Alexandre Belloni <alexandre.belloni@bootlin.com> | 2026-07-31 09:28:12 +0200 |
| commit | 74be657d98a8d684c0475f3cbd450ef2a30ffc73 (patch) | |
| tree | df4d3aab594e2fc05641aa513ea533fb95024b50 | |
| parent | 038cf48b3170af26a70bf2dee4f8c3ac910f5176 (diff) | |
i3c: master: Fix device_register() error path
When device_register() fails in i3c_master_register_new_i3c_devs(),
put_device() is called to drop the reference taken by
device_register(). That drops the last reference, so the device's
release callback i3c_device_release() runs and frees the i3c_device.
Two problems follow from that:
i3c_device_release() does WARN_ON(i3cdev->desc), so it warns because
desc->dev->desc still points back at the descriptor. Clear it before
calling put_device().
After put_device() frees the i3c_device, desc->dev is left pointing at
freed memory, so clear desc->dev as well. That prevents, for example,
i3c_master_unregister_i3c_devs() seeing desc->dev as non-NULL and
dereferencing it.
Reported-by: sashiko-bot@kernel.org
Link: https://lore.kernel.org/linux-i3c/20260701203053.8F3971F000E9@smtp.kernel.org/
Fixes: cab63f6488761 ("i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260702183644.60827-1-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
| -rw-r--r-- | drivers/i3c/master.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index f1be38a640ca..ac408086ddcc 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -1934,7 +1934,9 @@ i3c_master_register_new_i3c_devs(struct i3c_master_controller *master) if (ret) { dev_err(&master->dev, "Failed to add I3C device (err = %d)\n", ret); + desc->dev->desc = NULL; put_device(&desc->dev->dev); + desc->dev = NULL; } } } |