of_i3c_master_add_i2c_boardinfo() takes a reference to each Device Tree
child node so the fwnode stored in the persistent board info remains
valid. i2c_new_client_device() later takes its own reference for the
client, and client teardown only releases that reference. The original
board-info reference is therefore leaked for every DT-described I2C
device. Registration failures after bus population leak it as well.

Register the board-info node reference as a managed resource of the I3C
master. This retains it for the full board-info lifetime and releases it
on both registration failure and normal master teardown.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 3a379bbcea0af ("i3c: Add core I3C infrastructure")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/i3c/master.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index f1be38a640ca1..8063e2642cbda 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -2619,6 +2619,11 @@ EXPORT_SYMBOL_GPL(i3c_master_do_daa);
 
 #define OF_I3C_REG1_IS_I2C_DEV			BIT(31)
 
+static void of_i3c_master_put_node(void *data)
+{
+	of_node_put(data);
+}
+
 static int
 of_i3c_master_add_i2c_boardinfo(struct i3c_master_controller *master,
 				struct device_node *node, u32 *reg)
@@ -2648,8 +2653,12 @@ of_i3c_master_add_i2c_boardinfo(struct i3c_master_controller *master,
 	/* LVR is encoded in reg[2]. */
 	boardinfo->lvr = reg[2];
 
+	ret = devm_add_action_or_reset(dev, of_i3c_master_put_node,
+				       of_node_get(node));
+	if (ret)
+		return ret;
+
 	list_add_tail(&boardinfo->node, &master->boardinfo.i2c);
-	of_node_get(node);
 
 	return 0;
 }
-- 
2.51.0