Re: [PATCH net-next v5 3/4] net: pse-pd: realtek-pse-mcu: add I2C transport

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unsafe DMA on stack-allocated buffers in native I2C transport.
--

commit 0cfb33bb6548fde90d8e33161d69d564f969591e
Author: Jonas Jelonek <jelonek.jonas@gmail.com>

net: pse-pd: realtek-pse-mcu: add I2C transport

Add the I2C/SMBus transport for the Realtek/Broadcom PSE MCU core. It
registers the MCU on an I2C bus and provides the send/recv callbacks the
core uses to exchange the 12-byte frames.

> diff --git a/drivers/net/pse-pd/realtek-pse-mcu-i2c.c b/drivers/net/pse-pd/realtek-pse-mcu-i2c.c
> new file mode 100644
> index 0000000000000..6e6e3645c5090
> --- /dev/null
> +++ b/drivers/net/pse-pd/realtek-pse-mcu-i2c.c

[ ... ]

> +static int rtpse_mcu_i2c_native_send(struct rtpse_mcu_ctrl *pse, const struct rtpse_mcu_msg *req)
> +{
> +	struct i2c_client *client = to_i2c_client(pse->dev);
> +	int ret;
> +
> +	ret = i2c_master_send(client, (const u8 *)req, RTPSE_MCU_MSG_SIZE);

[Severity: High]
Does this code pass a stack-allocated buffer to i2c_master_send()?

If the underlying I2C bus master driver uses DMA for this 12-byte transfer,
passing a stack address can trigger a BUG/WARN on systems with
CONFIG_VMAP_STACK=y, or corrupt memory due to cache line sharing.

It looks like the req buffer is allocated on the stack in the core driver,
for example in rtpse_mcu_port_query():

drivers/net/pse-pd/realtek-pse-mcu-core.c:rtpse_mcu_port_query() {
	...
	struct rtpse_mcu_msg req;
	...
}

> +	if (ret < 0)
> +		return ret;
> +	return ret == RTPSE_MCU_MSG_SIZE ? 0 : -EIO;
> +}
> +
> +static int rtpse_mcu_i2c_native_recv(struct rtpse_mcu_ctrl *pse, const struct rtpse_mcu_msg *req,
> +				     struct rtpse_mcu_msg *resp)
> +{
> +	struct i2c_client *client = to_i2c_client(pse->dev);
> +	int tries, ret;
> +
> +	for (tries = 0; tries < RTPSE_MCU_I2C_MAX_TRIES; tries++) {
> +		if (tries > 0)
> +			msleep(RTPSE_MCU_I2C_RETRY_MS);
> +
> +		ret = i2c_master_recv(client, (u8 *)resp, RTPSE_MCU_MSG_SIZE);

[Severity: High]
Can this code also pass a stack-allocated buffer to i2c_master_recv()
for the resp pointer?

Like with req, resp also seems to be allocated on the stack in the core driver.

> +		if (ret < 0)
> +			return ret;
> +		if (ret == RTPSE_MCU_MSG_SIZE && rtpse_mcu_resp_is_final(req, resp))
> +			return 0;
> +	}
> +
> +	return -ETIMEDOUT;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706112425.3149226-1-jelonek.jonas@gmail.com?part=3