From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8E052C43458 for ; Wed, 1 Jul 2026 20:33:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=MfZx7L/zTBK9kWRuW4/L+zD9ZkzgFzfkDXMHRLM1nwg=; b=zSQ93Gx4dTVH4c RhIFVKqcEAx4awsMsoEtgeUNW06BkB+867iXe1iR9svpM6A9svP4Qo21ponCTBSLCJIbBTeOY4usl PC+FNdZZ78hAqnS1n3hyP3tZQ+5+P4IKz2IwUEsGJ+aPDwvhrDcanZiydEdtXEjKldoHEkZzLgnXI 2grSDx2QcCHA3/6JZxy4ZEKH3v20gSVrO5tHfBD6nf9/0TZavcwcsqzcsr8DZkhNHWCv6mKC8uSLc ZXS301nQDDSwTFOnegget9Jt8jOB2ZN8WKIVHxKXSsW7DWolwwBGLpJoOb2k/wJ4vmzESI9OwuYL8 fk9UUCIMBTLgrS2QLuQQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wf1cp-00000002yGY-1Idh; Wed, 01 Jul 2026 20:33:39 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wf1cn-00000002yGP-2RTr for linux-i3c@lists.infradead.org; Wed, 01 Jul 2026 20:33:37 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 48906407AB; Wed, 1 Jul 2026 20:33:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D13321F000E9; Wed, 1 Jul 2026 20:33:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1782938017; bh=NyVMPti0TCUuC112Dde4qDthm08jy8jxIFdrJwiV/Oc=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=GBdmx60UAv5LPWXpzLXTCa5ewIonKVWxFSAsI/PVek5Fn7PdFr3Znd6IpnoKViXWy MrcKC638sAs2xZRxN0oksf/bQxGwD+jYLDZAPHwjo4z16XZVYwfE3Q/IPlWTOlrpQ5 KkdpDoQR+Msrz+d5VA6EmROlYF2rWdKgjiyTs4NdltInKwIfgnBUI7VlzlAdNdqwaT uWPOh8h5BIrm351ykYvEe1J8vH3GXl3FTWJenr1vGx7JkbPw5Y0WFlc5IeRnpCeMU0 VCha7Un8CEMQhZFCshHo6YHNtPNRukrKuAAWkRNPgHDMvToiBHliV0R4T0Zo2PJHCC Ly2bqS4y8Jp7Q== From: sashiko-bot@kernel.org Subject: Re: [PATCH RFC RESEND 2/7] i3c: master: Report wakeup events for IBIs To: "Adrian Hunter" Cc: "Alexandre Belloni" , Frank.Li@kernel.org, linux-pci@vger.kernel.org, linux-i3c@lists.infradead.org In-Reply-To: <20260701201533.220818-3-adrian.hunter@intel.com> References: <20260701201533.220818-1-adrian.hunter@intel.com> <20260701201533.220818-3-adrian.hunter@intel.com> Date: Wed, 01 Jul 2026 20:33:36 +0000 Message-Id: <20260701203336.D13321F000E9@smtp.kernel.org> X-BeenThere: linux-i3c@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-i3c" Errors-To: linux-i3c-bounces+linux-i3c=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MiBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtIaWdoXSBV bmNvbmRpdGlvbmFsIE5VTEwgcG9pbnRlciBkZXJlZmVyZW5jZSBvZiBgZGV2LT5kZXZgIGluIGBp M2NfbWFzdGVyX3F1ZXVlX2liaWAgZHVyaW5nIGRldmljZSB0ZWFyZG93bgoKUHJlLWV4aXN0aW5n IGlzc3VlczoKLSBbSGlnaF0gTG9ja2xlc3MgVE9DVE9VIHJhY2UgbGVhZGluZyB0byBVc2UtQWZ0 ZXItRnJlZSBvZiBgZGV2LT5pYmlgIGR1cmluZyBjb25jdXJyZW50IElCSSB0ZWFyZG93bgotLQoK Y29tbWl0IGZmZGQ5YjA2NmEyYmRhZGVjYWFiMjA1ZDE4N2RhYjFhNWVjZmY1YWUKQXV0aG9yOiBB ZHJpYW4gSHVudGVyIDxhZHJpYW4uaHVudGVyQGludGVsLmNvbT4KCmkzYzogbWFzdGVyOiBSZXBv cnQgd2FrZXVwIGV2ZW50cyBmb3IgSUJJcwoKQW4gSTNDIGRldmljZSBjb25maWd1cmVkIGFzIGEg d2FrZXVwIHNvdXJjZSBjYW4gd2FrZSB0aGUgc3lzdGVtIGJ5CmdlbmVyYXRpbmcgYW4gSW4tQmFu ZCBJbnRlcnJ1cHQgKElCSSkuCgpXaGVuIGFuIElCSSBpcyBxdWV1ZWQgZm9yIHByb2Nlc3Npbmcs IHJlY29yZCBhIHdha2V1cCBldmVudCBmb3IgdGhlCmRldmljZSBpZiB3YWtldXAgaXMgZW5hYmxl ZC4gIFVzZSBhIDEwMCBtcyBwcm9jZXNzaW5nIGludGVydmFsIHRvIGdpdmUKdGhlIEkzQyBkZXZp Y2UgZHJpdmVyIHRpbWUgdG8gcHJvY2VzcyB0aGUgSUJJLgoKPiBkaWZmIC0tZ2l0IGEvZHJpdmVy cy9pM2MvbWFzdGVyLmMgYi9kcml2ZXJzL2kzYy9tYXN0ZXIuYwo+IGluZGV4IGE0N2UyOTI0YmI3 MDEuLmEzNmY5YjYxN2NiZjcgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVycy9pM2MvbWFzdGVyLmMKPiAr KysgYi9kcml2ZXJzL2kzYy9tYXN0ZXIuYwoKWyAuLi4gXQoKPiBAQCAtMzAwNyw2ICszMDEwLDkg QEAgdm9pZCBpM2NfbWFzdGVyX3F1ZXVlX2liaShzdHJ1Y3QgaTNjX2Rldl9kZXNjICpkZXYsIHN0 cnVjdCBpM2NfaWJpX3Nsb3QgKnNsb3QpCj4gIAlpZiAoIWRldi0+aWJpIHx8ICFzbG90KQo+ICAJ CXJldHVybjsKPiAgCj4gKwlpZiAoZGV2aWNlX21heV93YWtldXAoJmRldi0+ZGV2LT5kZXYpKQo+ ICsJCXBtX3dha2V1cF9ldmVudCgmZGV2LT5kZXYtPmRldiwgSTNDX1dBS0VVUF9QUk9DRVNTSU5H X1RJTUVfTVMpOwo+ICsKCltTZXZlcml0eTogSGlnaF0KRG9lcyB0aGlzIGNvZGUgaW50cm9kdWNl IGEgTlVMTCBwb2ludGVyIGRlcmVmZXJlbmNlIGlmIGFuIGludGVycnVwdCBhcnJpdmVzCmR1cmlu ZyBkZXZpY2UgdGVhcmRvd24/CgpEdXJpbmcgSTNDIG1hc3RlciBjb250cm9sbGVyIHVucmVnaXN0 cmF0aW9uLCBpM2NfbWFzdGVyX3VucmVnaXN0ZXJfaTNjX2RldnMoKQpjbGVhcnMgdGhlIGRldmlj ZSBkZXNjcmlwdGlvbiBhbmQgc2V0cyBpM2NkZXYtPmRldiB0byBOVUxMOgoKCWkzY2Rldi0+ZGV2 LT5kZXNjID0gTlVMTDsKCWlmIChkZXZpY2VfaXNfcmVnaXN0ZXJlZCgmaTNjZGV2LT5kZXYtPmRl dikpCgkJZGV2aWNlX3VucmVnaXN0ZXIoJmkzY2Rldi0+ZGV2LT5kZXYpOwoJZWxzZQoJCXB1dF9k ZXZpY2UoJmkzY2Rldi0+ZGV2LT5kZXYpOwoJaTNjZGV2LT5kZXYgPSBOVUxMOwoKU2luY2UgY2xl YXJpbmcgZGV2LT5kZXNjIHByZXZlbnRzIHRoZSBkcml2ZXIncyByZW1vdmUgY2FsbGJhY2sgZnJv bSBkaXNhYmxpbmcKdGhlIGhhcmR3YXJlIElCSSwgdGhlIElCSSBtYXkgc3RpbGwgZmlyZS4gSWYg aTNjX21hc3Rlcl9xdWV1ZV9pYmkoKSBleGVjdXRlcwphdCB0aGlzIHBvaW50LCB0aGUgbmV3bHkg YWRkZWQgZGV2aWNlX21heV93YWtldXAoJmRldi0+ZGV2LT5kZXYpIHdpbGwKZGVyZWZlcmVuY2Ug dGhlIE5VTEwgZGV2LT5kZXYgcG9pbnRlci4KCj4gIAlhdG9taWNfaW5jKCZkZXYtPmliaS0+cGVu ZGluZ19pYmlzKTsKCltTZXZlcml0eTogSGlnaF0KVGhpcyBpcyBhIHByZS1leGlzdGluZyBpc3N1 ZSwgYnV0IGRvZXMgdGhpcyBsb2NrbGVzcyBjaGVjayBvcGVuIGEgCnVzZS1hZnRlci1mcmVlIHJh Y2Ugd2luZG93PwoKSWYgYSBoYXJkd2FyZSBJQkkgaW50ZXJydXB0IGlzIHByb2Nlc3NlZCBjb25j dXJyZW50bHkgb24gYW5vdGhlciBDUFUsIGl0IGNhbgpldmFsdWF0ZSBpZiAoIWRldi0+aWJpKSBh cyBmYWxzZSwgZ2V0IHByZWVtcHRlZCwgYW5kIHRoZW4gYWNjZXNzCmRldi0+aWJpLT5wZW5kaW5n X2liaXMgYW5kIGRldi0+aWJpLT53cSBhZnRlciB0aGV5IGhhdmUgYmVlbiBmcmVlZCBieQppM2Nf ZGV2X2ZyZWVfaWJpX2xvY2tlZCgpOgoKCWtmcmVlKGRldi0+aWJpKTsKCWRldi0+aWJpID0gTlVM TDsKClRoaXMgaXMgcG9zc2libGUgZm9yIGhhcmR3YXJlIGNvbnRyb2xsZXJzIGxpa2UgZHctaTNj LW1hc3RlciB0aGF0IGRvIG5vdAppbXBsaWNpdGx5IHN5bmNocm9uaXplIHdpdGggZXhlY3V0aW5n IGhhcmR3YXJlIElSUSBoYW5kbGVycyBkdXJpbmcgdGhlaXIKZGlzYWJsZSBvcC4KCj4gIAlxdWV1 ZV93b3JrKGRldi0+aWJpLT53cSwgJnNsb3QtPndvcmspOwo+ICB9CgotLSAKU2FzaGlrbyBBSSBy ZXZpZXcgwrcgaHR0cHM6Ly9zYXNoaWtvLmRldi8jL3BhdGNoc2V0LzIwMjYwNzAxMjAxNTMzLjIy MDgxOC0xLWFkcmlhbi5odW50ZXJAaW50ZWwuY29tP3BhcnQ9MgoKLS0gCmxpbnV4LWkzYyBtYWls aW5nIGxpc3QKbGludXgtaTNjQGxpc3RzLmluZnJhZGVhZC5vcmcKaHR0cDovL2xpc3RzLmluZnJh ZGVhZC5vcmcvbWFpbG1hbi9saXN0aW5mby9saW51eC1pM2MK From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7EB5734D3BE for ; Wed, 1 Jul 2026 20:33:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782938018; cv=none; b=UdJSn2UITIaFCLwo/g9VFh7ZdHjqTDU6RRMdQQ+5cWztkqxXi4+cFY8e6uLkBk/Uw8QFW4emhGxmmkS62qt2jdnqbW51iW8MlKlUsN4VLHmpqMa2TOJxr1zWJbL3dX+cheMiKIqtMPXDVnXpPITbMoG7QyCuiar7Y2asrX5q4OU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782938018; c=relaxed/simple; bh=ELZutrj0QBfagOITFRDtjnOLG4ZbOXcswclL+n1kmu0=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=Yq6xLQei8gd/FMAu2aVmqat+kfc/8AeeCyXz9AGHKXX3KfBQv8RrBEOSEik/Bg8cwVEryblnqF96eAdWfNLOath6fvNQsesji2eT1hhqN6ZBzxrR7JczuW+jfbvo/G9KPUPIO3hXqPuHjsT/3oZSUvs1XUhoKyaaTG/YyGpuQtg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=GBdmx60U; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="GBdmx60U" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D13321F000E9; Wed, 1 Jul 2026 20:33:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1782938017; bh=NyVMPti0TCUuC112Dde4qDthm08jy8jxIFdrJwiV/Oc=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=GBdmx60UAv5LPWXpzLXTCa5ewIonKVWxFSAsI/PVek5Fn7PdFr3Znd6IpnoKViXWy MrcKC638sAs2xZRxN0oksf/bQxGwD+jYLDZAPHwjo4z16XZVYwfE3Q/IPlWTOlrpQ5 KkdpDoQR+Msrz+d5VA6EmROlYF2rWdKgjiyTs4NdltInKwIfgnBUI7VlzlAdNdqwaT uWPOh8h5BIrm351ykYvEe1J8vH3GXl3FTWJenr1vGx7JkbPw5Y0WFlc5IeRnpCeMU0 VCha7Un8CEMQhZFCshHo6YHNtPNRukrKuAAWkRNPgHDMvToiBHliV0R4T0Zo2PJHCC Ly2bqS4y8Jp7Q== From: sashiko-bot@kernel.org Subject: Re: [PATCH RFC RESEND 2/7] i3c: master: Report wakeup events for IBIs Reply-To: sashiko-reviews@lists.linux.dev To: "Adrian Hunter" Cc: "Alexandre Belloni" , Frank.Li@kernel.org, linux-pci@vger.kernel.org, linux-i3c@lists.infradead.org In-Reply-To: <20260701201533.220818-3-adrian.hunter@intel.com> References: <20260701201533.220818-1-adrian.hunter@intel.com> <20260701201533.220818-3-adrian.hunter@intel.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Wed, 01 Jul 2026 20:33:36 +0000 Message-Id: <20260701203336.D13321F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: linux-pci@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 2 potential issue(= s) to consider: New issues: - [High] Unconditional NULL pointer dereference of `dev->dev` in `i3c_maste= r_queue_ibi` during device teardown Pre-existing issues: - [High] Lockless TOCTOU race leading to Use-After-Free of `dev->ibi` durin= g concurrent IBI teardown -- commit ffdd9b066a2bdadecaab205d187dab1a5ecff5ae Author: Adrian Hunter i3c: master: Report wakeup events for IBIs An I3C device configured as a wakeup source can wake the system by generating an In-Band Interrupt (IBI). When an IBI is queued for processing, record a wakeup event for the device if wakeup is enabled. Use a 100 ms processing interval to give the I3C device driver time to process the IBI. > diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c > index a47e2924bb701..a36f9b617cbf7 100644 > --- a/drivers/i3c/master.c > +++ b/drivers/i3c/master.c [ ... ] > @@ -3007,6 +3010,9 @@ void i3c_master_queue_ibi(struct i3c_dev_desc *dev,= struct i3c_ibi_slot *slot) > if (!dev->ibi || !slot) > return; > =20 > + if (device_may_wakeup(&dev->dev->dev)) > + pm_wakeup_event(&dev->dev->dev, I3C_WAKEUP_PROCESSING_TIME_MS); > + [Severity: High] Does this code introduce a NULL pointer dereference if an interrupt arrives during device teardown? During I3C master controller unregistration, i3c_master_unregister_i3c_devs= () clears the device description and sets i3cdev->dev to NULL: i3cdev->dev->desc =3D NULL; if (device_is_registered(&i3cdev->dev->dev)) device_unregister(&i3cdev->dev->dev); else put_device(&i3cdev->dev->dev); i3cdev->dev =3D NULL; Since clearing dev->desc prevents the driver's remove callback from disabli= ng the hardware IBI, the IBI may still fire. If i3c_master_queue_ibi() executes at this point, the newly added device_may_wakeup(&dev->dev->dev) will dereference the NULL dev->dev pointer. > atomic_inc(&dev->ibi->pending_ibis); [Severity: High] This is a pre-existing issue, but does this lockless check open a=20 use-after-free race window? If a hardware IBI interrupt is processed concurrently on another CPU, it can evaluate if (!dev->ibi) as false, get preempted, and then access dev->ibi->pending_ibis and dev->ibi->wq after they have been freed by i3c_dev_free_ibi_locked(): kfree(dev->ibi); dev->ibi =3D NULL; This is possible for hardware controllers like dw-i3c-master that do not implicitly synchronize with executing hardware IRQ handlers during their disable op. > queue_work(dev->ibi->wq, &slot->work); > } --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260701201533.2208= 18-1-adrian.hunter@intel.com?part=3D2