From: Jakub Kicinski <kuba@kernel.org>
To: Frank Li <Frank.li@oss.nxp.com>
Cc: linux-i3c@lists.infradead.org, alexandre.belloni@bootlin.com,
Frank.Li@nxp.com, adrianhoyin.ng@altera.com, ustc.gu@gmail.com,
bbrezillon@kernel.org, vitor.soares@synopsys.com
Subject: Re: [PATCH v2] i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
Date: Wed, 1 Jul 2026 11:30:43 -0700 [thread overview]
Message-ID: <20260701113043.726e0e86@kernel.org> (raw)
In-Reply-To: <akVcAZzT-WGHZNWp@lizhi-Precision-Tower-5810>
On Wed, 1 Jul 2026 14:27:13 -0400 Frank Li wrote:
> On Tue, Jun 30, 2026 at 10:29:04AM -0700, Jakub Kicinski wrote:
> > On an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count
> > of addresses left unassigned) equals master->maxdevs.
> >
> > The GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1,
> > which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD
> > server:
> >
> > UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12
> > shift exponent 64 is too large for 64-bit type 'long unsigned int'
> > CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy)
> > Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026
> > Call Trace:
> > <TASK>
> > dump_stack_lvl+0x5d/0x80
> > ubsan_epilogue+0x5/0x2b
> > __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab
> > dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master]
> > i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c]
> >
> > Skip the mask when no new device was assigned.
> >
> > Fixes: 1dd728f5d4d4 ("i3c: master: Add driver for Synopsys DesignWare IP")
> > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> > ---
> Next time add change log here.
My bad, I guess slipped my mind since there were no changes of any real
significance :/
v2:
- whitespace changes
- s/We see this/This happens/ in the commit message
v1: https://lore.kernel.org/20260629233650.2148827-1-kuba@kernel.org/
--
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c
next prev parent reply other threads:[~2026-07-01 18:30 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-30 17:29 [PATCH v2] i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices Jakub Kicinski
2026-07-01 18:27 ` Frank Li
2026-07-01 18:30 ` Jakub Kicinski [this message]
2026-07-05 21:34 ` Alexandre Belloni
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260701113043.726e0e86@kernel.org \
--to=kuba@kernel.org \
--cc=Frank.Li@nxp.com \
--cc=Frank.li@oss.nxp.com \
--cc=adrianhoyin.ng@altera.com \
--cc=alexandre.belloni@bootlin.com \
--cc=bbrezillon@kernel.org \
--cc=linux-i3c@lists.infradead.org \
--cc=ustc.gu@gmail.com \
--cc=vitor.soares@synopsys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.