From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9A87ACD98DA for ; Tue, 16 Jun 2026 10:12:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Lo/SBPbZocQV2OioasyCGsTOHmVUx9cLeC2xth9vRbY=; b=Iz4ZKukaXKTP7H HjCDvZ8CeKeCr2By5XIVC2ImfG8PYm+zyhqcLDLiU/Aiy7oF1pj0Tboz2e+wDGwqOfc+jRXVPTwM2 UR47CcxylKD7GpIVPYoTh7He0ur470ww385d06DMKqCsyaWoqdWByFWwTIQH6dbLCsKsCI+hU+zdZ lBpwnO8d0WBhIDq5mzaHSuqGZyqVRSc+YHPGxeFTYn4Rai/I7nE4X6/dlQmRBdC0rwqyBRErrnlYM JvjfVs+y0GBBU/0s+rD4N/atGpWyvbr4BGng+JoBddS+hri9EyP1SMMjFCukIc+Zv6h4synhjChXn YQhFNEsJj3mqb/i65YJQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wZQmY-0000000FaCe-3hmB; Tue, 16 Jun 2026 10:12:34 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wZQmW-0000000FaCI-45ST for linux-i3c@lists.infradead.org; Tue, 16 Jun 2026 10:12:33 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 1D14160132; Tue, 16 Jun 2026 10:12:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A93B1F00A3A; Tue, 16 Jun 2026 10:12:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781604751; bh=gDyBzQm7pmBkJMLlglN9wxxwMYLONHM9TCoBw5z/hG8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=nHpYlzyONSipMoRaI9vYtn0uTyZRMkwVneOILljrI44eHkXhRritXbzj4z71sYvPu PQms7b+5amFPWwtXGNSSdJ4+D6URbl34aWfhvGrN9P95m7yptg2AB+pnSsmTmQpAyL DJcGy3mrqsJvhEC2OLw7itYcvdm7dgc662nzc0Zj6i9OJwn15Ma/0OYtxhXAzU/Jt7 nqtvFVrxBSkO1dDc5lrgsWuF60qKia9MnQ/FY8K16zZ2ZB+bSNhh8ACTXG2h28N2Nv 83ggrJpw5r4JaGk79zFOm0ajjQKYOgAtk7WqvMsOtRzPbr9GGtN4j97rJrwuDp4W13 pnhK1dYxIedzw== From: sashiko-bot@kernel.org Subject: Re: [PATCH v4 06/12] i3c: master: match I3C device through DT and ACPI To: "Akhil R" Cc: Frank.Li@kernel.org, linux-hwmon@vger.kernel.org, robh@kernel.org, devicetree@vger.kernel.org, linux-i3c@lists.infradead.org, conor+dt@kernel.org In-Reply-To: <20260616095429.3947205-7-akhilrajeev@nvidia.com> References: <20260616095429.3947205-7-akhilrajeev@nvidia.com> Date: Tue, 16 Jun 2026 10:12:30 +0000 Message-Id: <20260616101231.3A93B1F00A3A@smtp.kernel.org> X-BeenThere: linux-i3c@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-i3c" Errors-To: linux-i3c-bounces+linux-i3c=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MyBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtIaWdoXSBM b2NrbGVzcyBhY2Nlc3MgdG8gYGkzY2Rldi0+ZGVzY2AgaW50cm9kdWNlcyBhIFRpbWUtb2YtQ2hl Y2sgdG8gVGltZS1vZi1Vc2UgKFRPQ1RPVSkgcmFjZSwgVXNlLUFmdGVyLUZyZWUgKFVBRiksIGFu ZCBOVUxMIHBvaW50ZXIgZGVyZWZlcmVuY2Ugd2hlbiBhIGRldmljZSBpcyBjb25jdXJyZW50bHkg bWF0Y2hlZCBhbmQgdW5yZWdpc3RlcmVkLgotIFtNZWRpdW1dIE1pc3NpbmcgT0YgYW5kIEFDUEkg bW9kYWxpYXMgZ2VuZXJhdGlvbiBpbiBgaTNjX2RldmljZV91ZXZlbnRgIGJyZWFrcyBtb2R1bGUg YXV0b2xvYWRpbmcgZm9yIFNFVEFBU0EtYmFzZWQgSTNDIGRldmljZXMuCgpQcmUtZXhpc3Rpbmcg aXNzdWVzOgotIFtIaWdoXSBNYXRjaGluZyBsb2dpYyByZWFkcyB1bmluaXRpYWxpemVkIHN0YWNr IG1lbW9yeSB3aGVuIGkzY2Rldi0+ZGVzYyBpcyBOVUxMLgotLQoKY29tbWl0IDNkYmNmM2JmNzI2 OThmM2RlOTBlMzI3ZTU5Y2ZiMjkxM2VjZDc1MDMKQXV0aG9yOiBBa2hpbCBSIDxha2hpbHJhamVl dkBudmlkaWEuY29tPgoKaTNjOiBtYXN0ZXI6IG1hdGNoIEkzQyBkZXZpY2UgdGhyb3VnaCBEVCBh bmQgQUNQSQoKU0VUQUFTQS1iYXNlZCBkZXZpY2VzIGNhbm5vdCBhbHdheXMgYmUgaWRlbnRpZmll ZCBieSBQSUQgb3IgRENSOyB0aGUKc3RhbmRhcmQgSTNDIGlkX3RhYmxlIG1hdGNoaW5nIG1heSBu b3QgYmUgYXBwbGljYWJsZS4gQWxsb3cgc3VjaCBkZXZpY2VzCnRvIGJlIG1hdGNoZWQgdGhyb3Vn aCBEZXZpY2UgVHJlZSBvciBBQ1BJLgoKPiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9pM2MvbWFzdGVy LmMgYi9kcml2ZXJzL2kzYy9tYXN0ZXIuYwo+IGluZGV4IGJjYzljMmQyOWMzNDIuLjFiZDU0NTQ0 N2I4MTcgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVycy9pM2MvbWFzdGVyLmMKPiArKysgYi9kcml2ZXJz L2kzYy9tYXN0ZXIuYwpbIC4uLiBdCj4gQEAgLTM0NSwxNSArMzQ2LDMyIEBAIHN0YXRpYyBpbnQg aTNjX2RldmljZV9tYXRjaChzdHJ1Y3QgZGV2aWNlICpkZXYsIGNvbnN0IHN0cnVjdCBkZXZpY2Vf ZHJpdmVyICpkcnYpCj4gIHsKPiAgCXN0cnVjdCBpM2NfZGV2aWNlICppM2NkZXY7Cj4gIAljb25z dCBzdHJ1Y3QgaTNjX2RyaXZlciAqaTNjZHJ2Owo+ICsJdTggc3RhdGljX2FkZHJfbWV0aG9kID0g MDsKPiAgCj4gIAlpZiAoZGV2LT50eXBlICE9ICZpM2NfZGV2aWNlX3R5cGUpCj4gIAkJcmV0dXJu IDA7Cj4gIAo+ICAJaTNjZGV2ID0gZGV2X3RvX2kzY2RldihkZXYpOwo+ICAJaTNjZHJ2ID0gZHJ2 X3RvX2kzY2RydihkcnYpOwo+IC0JaWYgKGkzY19kZXZpY2VfbWF0Y2hfaWQoaTNjZGV2LCBpM2Nk cnYtPmlkX3RhYmxlKSkKPiArCj4gKwlpZiAoaTNjZGV2LT5kZXNjICYmIGkzY2Rldi0+ZGVzYy0+ Ym9hcmRpbmZvKQo+ICsJCXN0YXRpY19hZGRyX21ldGhvZCA9IGkzY2Rldi0+ZGVzYy0+Ym9hcmRp bmZvLT5zdGF0aWNfYWRkcl9tZXRob2Q7CgpbU2V2ZXJpdHk6IEhpZ2hdCkNhbiB0aGlzIGxvY2ts ZXNzIGFjY2VzcyB0byBpM2NkZXYtPmRlc2MgY2F1c2UgYSBVc2UtQWZ0ZXItRnJlZSBvciBOVUxM CnBvaW50ZXIgZGVyZWZlcmVuY2U/CgpJZiB0aGUgSTNDIG1hc3RlciBpcyB1bmJvdW5kIG9yIHVu cmVnaXN0ZXJlZCBjb25jdXJyZW50bHksCmkzY19tYXN0ZXJfdW5yZWdpc3Rlcl9pM2NfZGV2cygp IHNldHMgaTNjZGV2LT5kZXYtPmRlc2MgPSBOVUxMIGxvY2tsZXNzbHkgYW5kCmNhbGxzIGRldmlj ZV91bnJlZ2lzdGVyKCkuCgpTaW5jZSBpM2NfZGV2aWNlX21hdGNoKCkgaXMgY2FsbGVkIGZyb20g YnVzX2Zvcl9lYWNoX2RldigpIHdpdGhvdXQgdGFraW5nIHRoZQpkZXZpY2UgbG9jaywgaWYgdGhl IHRocmVhZCBpcyBwcmVlbXB0ZWQgYmV0d2VlbiBjaGVja2luZyBpM2NkZXYtPmRlc2MgYW5kCnJl YWRpbmcgZGVzYy0+Ym9hcmRpbmZvLCBkZXNjIGNvdWxkIGJlIGZyZWVkIGJ5IGkzY19tYXN0ZXJf YnVzX2NsZWFudXAoKSwKY2F1c2luZyBhIFVzZS1BZnRlci1GcmVlLgoKQWx0ZXJuYXRpdmVseSwg d2l0aG91dCBSRUFEX09OQ0UoKSwgY291bGQgdGhlIGNvbXBpbGVyIHJlbG9hZCBpM2NkZXYtPmRl c2MgYXMKTlVMTCwgY2F1c2luZyBhIGRpcmVjdCBOVUxMIHBvaW50ZXIgZGVyZWZlcmVuY2U/Cgo+ ICsKPiArCS8qCj4gKwkgKiBTRVRBQVNBLWJhc2VkIGRldmljZXMgbmVlZCBub3QgYWx3YXlzIGhh dmUgYSBtYXRjaGluZyBJRCBzaW5jZQo+ICsJICogaXQgaXMgbm90IG1hbmRhdG9yeSBmb3Igc3Vj aCBkZXZpY2VzIHRvIGltcGxlbWVudCBkZXZpY2VpbmZvCj4gKwkgKiBDQ0MgY29tbWFuZHMuIEFs bG93IHRoZW0gdG8gcmVnaXN0ZXIgdGhyb3VnaCBEVCBvciBBQ1BJLgo+ICsJICovCj4gKwlpZiAo aTNjZHJ2LT5pZF90YWJsZSAmJiBpM2NfZGV2aWNlX21hdGNoX2lkKGkzY2RldiwgaTNjZHJ2LT5p ZF90YWJsZSkpCgpbU2V2ZXJpdHk6IEhpZ2hdClRoaXMgaXMgYSBwcmUtZXhpc3RpbmcgaXNzdWUs IGJ1dCBjYW4gaTNjX2RldmljZV9tYXRjaF9pZCgpIG9wZXJhdGUgb24KdW5pbml0aWFsaXplZCBz dGFjayBtZW1vcnkgaGVyZT8KCklmIGkzY2Rldi0+ZGVzYyBpcyBOVUxMICh3aGljaCBjYW4gaGFw cGVuIGNvbmN1cnJlbnRseSBkdXJpbmcgZGV2aWNlIHRlYXJkb3duCnZpYSBpM2NfbWFzdGVyX3Vu cmVnaXN0ZXJfaTNjX2RldnMoKSksIGkzY19kZXZpY2VfZ2V0X2luZm8oKSByZXR1cm5zIGVhcmx5 CndpdGhvdXQgbW9kaWZ5aW5nIHRoZSBkZXZpbmZvIG91dHB1dCBidWZmZXI6Cgpkcml2ZXJzL2kz Yy9kZXZpY2UuYzppM2NfZGV2aWNlX21hdGNoX2lkKCkgewoJc3RydWN0IGkzY19kZXZpY2VfaW5m byBkZXZpbmZvOwoJLi4uCglpM2NfZGV2aWNlX2dldF9pbmZvKGkzY2RldiwgJmRldmluZm8pOwoK CW1hbnVmID0gSTNDX1BJRF9NQU5VRl9JRChkZXZpbmZvLnBpZCk7CgkuLi4KfQoKVGhpcyBsZWF2 ZXMgZGV2aW5mbyB1bmluaXRpYWxpemVkLCBjYXVzaW5nIHRoZSBtYXRjaGluZyBsb2dpYyB0byBl eHRyYWN0CnRoZSBtYW51ZmFjdHVyZXIgYW5kIHBhcnQgSURzIGZyb20gc3RhY2sgZ2FyYmFnZS4K Cj4gIAkJcmV0dXJuIDE7Cj4gIAo+ICsJaWYgKHN0YXRpY19hZGRyX21ldGhvZCAmIEkzQ19BRERS X01FVEhPRF9TRVRBQVNBKSB7Cj4gKwkJaWYgKG9mX2RyaXZlcl9tYXRjaF9kZXZpY2UoZGV2LCBk cnYpKQo+ICsJCQlyZXR1cm4gMTsKPiArCQlpZiAoYWNwaV9kcml2ZXJfbWF0Y2hfZGV2aWNlKGRl diwgZHJ2KSkKPiArCQkJcmV0dXJuIDE7CgpbU2V2ZXJpdHk6IE1lZGl1bV0KU2luY2UgdGhpcyBw YXRjaCBlbmFibGVzIERldmljZSBUcmVlIGFuZCBBQ1BJIG1hdGNoaW5nLCBkb2VzIHRoZSBidXMg dWV2ZW50CmNhbGxiYWNrIChpM2NfZGV2aWNlX3VldmVudCgpKSBhbHNvIG5lZWQgdG8gZ2VuZXJh dGUgT0YgYW5kIEFDUEkgbW9kYWxpYXNlcz8KCldpdGhvdXQgb2ZfZGV2aWNlX3VldmVudF9tb2Rh bGlhcygpIG9yIGFjcGlfZGV2aWNlX3VldmVudF9tb2RhbGlhcygpLCB1ZGV2CmNhbm5vdCBhdXRv bWF0aWNhbGx5IGxvYWQgdGhlIGRyaXZlciBiYXNlZCBvbiB0aGUgRFQgY29tcGF0aWJsZSBzdHJp bmcgb3IgQUNQSQpISUQsIHdoaWNoIGJyZWFrcyBtb2R1bGUgYXV0b2xvYWRpbmcgZm9yIFNFVEFB U0EtYmFzZWQgZGV2aWNlcy4KCj4gKwl9Cj4gKwo+ICAJcmV0dXJuIDA7Cj4gIH0KCi0tIApTYXNo aWtvIEFJIHJldmlldyDCtyBodHRwczovL3Nhc2hpa28uZGV2LyMvcGF0Y2hzZXQvMjAyNjA2MTYw OTU0MjkuMzk0NzIwNS0xLWFraGlscmFqZWV2QG52aWRpYS5jb20/cGFydD02CgotLSAKbGludXgt aTNjIG1haWxpbmcgbGlzdApsaW51eC1pM2NAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlz dHMuaW5mcmFkZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWkzYwo= From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 22339466B5C; Tue, 16 Jun 2026 10:12:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781604753; cv=none; b=fWTQjc+pYk3/aHFdTcvkLF6NMpssstZ+IYbpe8G89Q/IfBDDpaLlAYha4E4uT0ZgEwbdpL8Juqvt0iTLxqQ90MIPYb7u+extESSkTkzcdw/fDYimz+R0C4yGQJUnHIx8CKLwTEopoOrEyiP4aQ0mAoLFVPk8eHE8Ic9ZRTscmUc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781604753; c=relaxed/simple; bh=H7BK4jfl+64564s8cTfW9KaOksLfSNfnSy9wSJIVrQA=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=pZ/+I7MK1V86sy6vpAJ0bir6o3xZOVB8sfNwulF0Cq76VIQc3kPEE9LqS+UiXUfs0wtnYe6hbiiLE1eBFGwgEKnbFsHd35NBMi605c2tU8ZVyi1zF8Kv/q7/7AM4JLUl6fqojqnpFWZseZoT6r3R4ICDm5OSZKqXqXsFEai177U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=nHpYlzyO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="nHpYlzyO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A93B1F00A3A; Tue, 16 Jun 2026 10:12:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781604751; bh=gDyBzQm7pmBkJMLlglN9wxxwMYLONHM9TCoBw5z/hG8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=nHpYlzyONSipMoRaI9vYtn0uTyZRMkwVneOILljrI44eHkXhRritXbzj4z71sYvPu PQms7b+5amFPWwtXGNSSdJ4+D6URbl34aWfhvGrN9P95m7yptg2AB+pnSsmTmQpAyL DJcGy3mrqsJvhEC2OLw7itYcvdm7dgc662nzc0Zj6i9OJwn15Ma/0OYtxhXAzU/Jt7 nqtvFVrxBSkO1dDc5lrgsWuF60qKia9MnQ/FY8K16zZ2ZB+bSNhh8ACTXG2h28N2Nv 83ggrJpw5r4JaGk79zFOm0ajjQKYOgAtk7WqvMsOtRzPbr9GGtN4j97rJrwuDp4W13 pnhK1dYxIedzw== From: sashiko-bot@kernel.org Subject: Re: [PATCH v4 06/12] i3c: master: match I3C device through DT and ACPI Reply-To: sashiko-reviews@lists.linux.dev To: "Akhil R" Cc: Frank.Li@kernel.org, linux-hwmon@vger.kernel.org, robh@kernel.org, devicetree@vger.kernel.org, linux-i3c@lists.infradead.org, conor+dt@kernel.org In-Reply-To: <20260616095429.3947205-7-akhilrajeev@nvidia.com> References: <20260616095429.3947205-7-akhilrajeev@nvidia.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 16 Jun 2026 10:12:30 +0000 Message-Id: <20260616101231.3A93B1F00A3A@smtp.kernel.org> Precedence: bulk X-Mailing-List: linux-hwmon@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 3 potential issue(= s) to consider: New issues: - [High] Lockless access to `i3cdev->desc` introduces a Time-of-Check to Ti= me-of-Use (TOCTOU) race, Use-After-Free (UAF), and NULL pointer dereference= when a device is concurrently matched and unregistered. - [Medium] Missing OF and ACPI modalias generation in `i3c_device_uevent` b= reaks module autoloading for SETAASA-based I3C devices. Pre-existing issues: - [High] Matching logic reads uninitialized stack memory when i3cdev->desc = is NULL. -- commit 3dbcf3bf72698f3de90e327e59cfb2913ecd7503 Author: Akhil R i3c: master: match I3C device through DT and ACPI SETAASA-based devices cannot always be identified by PID or DCR; the standard I3C id_table matching may not be applicable. Allow such devices to be matched through Device Tree or ACPI. > diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c > index bcc9c2d29c342..1bd545447b817 100644 > --- a/drivers/i3c/master.c > +++ b/drivers/i3c/master.c [ ... ] > @@ -345,15 +346,32 @@ static int i3c_device_match(struct device *dev, con= st struct device_driver *drv) > { > struct i3c_device *i3cdev; > const struct i3c_driver *i3cdrv; > + u8 static_addr_method =3D 0; > =20 > if (dev->type !=3D &i3c_device_type) > return 0; > =20 > i3cdev =3D dev_to_i3cdev(dev); > i3cdrv =3D drv_to_i3cdrv(drv); > - if (i3c_device_match_id(i3cdev, i3cdrv->id_table)) > + > + if (i3cdev->desc && i3cdev->desc->boardinfo) > + static_addr_method =3D i3cdev->desc->boardinfo->static_addr_method; [Severity: High] Can this lockless access to i3cdev->desc cause a Use-After-Free or NULL pointer dereference? If the I3C master is unbound or unregistered concurrently, i3c_master_unregister_i3c_devs() sets i3cdev->dev->desc =3D NULL locklessly= and calls device_unregister(). Since i3c_device_match() is called from bus_for_each_dev() without taking t= he device lock, if the thread is preempted between checking i3cdev->desc and reading desc->boardinfo, desc could be freed by i3c_master_bus_cleanup(), causing a Use-After-Free. Alternatively, without READ_ONCE(), could the compiler reload i3cdev->desc = as NULL, causing a direct NULL pointer dereference? > + > + /* > + * SETAASA-based devices need not always have a matching ID since > + * it is not mandatory for such devices to implement deviceinfo > + * CCC commands. Allow them to register through DT or ACPI. > + */ > + if (i3cdrv->id_table && i3c_device_match_id(i3cdev, i3cdrv->id_table)) [Severity: High] This is a pre-existing issue, but can i3c_device_match_id() operate on uninitialized stack memory here? If i3cdev->desc is NULL (which can happen concurrently during device teardo= wn via i3c_master_unregister_i3c_devs()), i3c_device_get_info() returns early without modifying the devinfo output buffer: drivers/i3c/device.c:i3c_device_match_id() { struct i3c_device_info devinfo; ... i3c_device_get_info(i3cdev, &devinfo); manuf =3D I3C_PID_MANUF_ID(devinfo.pid); ... } This leaves devinfo uninitialized, causing the matching logic to extract the manufacturer and part IDs from stack garbage. > return 1; > =20 > + if (static_addr_method & I3C_ADDR_METHOD_SETAASA) { > + if (of_driver_match_device(dev, drv)) > + return 1; > + if (acpi_driver_match_device(dev, drv)) > + return 1; [Severity: Medium] Since this patch enables Device Tree and ACPI matching, does the bus uevent callback (i3c_device_uevent()) also need to generate OF and ACPI modaliases? Without of_device_uevent_modalias() or acpi_device_uevent_modalias(), udev cannot automatically load the driver based on the DT compatible string or A= CPI HID, which breaks module autoloading for SETAASA-based devices. > + } > + > return 0; > } --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260616095429.3947= 205-1-akhilrajeev@nvidia.com?part=3D6