From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59342415F1A; Tue, 21 Jul 2026 19:38:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784662717; cv=none; b=k7RY3kXP/RB8b6Yk7TURGvbV2xv53n7qhM03SDJFPDWpJdyf2HDG7hRr+Te2JqRGz5+h4BX/5qLtti5+0nmEblDRQvK+UAn1wjHvyssXKLrRz4F2DGhWgrRWhlXGHtmYSJtC1kIvVsp6C4gMllpmivpA9C+aiv9yMXbSC66Rx8w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784662717; c=relaxed/simple; bh=6laJXuoiiWCJg5dITAxH/ss87CEBkIBEPBeveXFYPuA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XgSrkTV2mZ/afuqEa4M1LBU47+g93MpgclI+lflsETD/olYhG/gOTqGe64yHK8WKHHGHGdFw65Ua/2JegFzJy87mSmXBMrxWnQFCw/QLEiVF7cBDLVTAlM9CgVD/6JehObCENu/fiEig50iMF1vpS99rU3pOurHUzJ/+VIdz55s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aRghmGww; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="aRghmGww" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BFEC21F000E9; Tue, 21 Jul 2026 19:38:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784662716; bh=GEiatgmQPlFVjAk1cdbdNcZPI7A1st340ycW1MOBAbY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=aRghmGwwALe5ZZkj1FDTr705rBQTsfpXKnTiGa5uunce1EIDKJMDWgunDKE11fsdd +rFeIpcvhE0W1CoQ8yf7LL5/2PoNGWgQCoT4JutYE82JN8DSCgE8kL7wafeXH2NCWV yFYUx4os9fIH8YxyntZ1PemzA7bLu2qHNkOn2IXQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Adrian Hunter , Frank Li , Alexandre Belloni , Sasha Levin Subject: [PATCH 6.12 0548/1276] i3c: master: Prevent reuse of dynamic address on device add failure Date: Tue, 21 Jul 2026 17:16:31 +0200 Message-ID: <20260721152458.386783155@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152446.065700225@linuxfoundation.org> References: <20260721152446.065700225@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Adrian Hunter [ Upstream commit b3ba8383da4d0cff15810e32ea785eceb0a80813 ] i3c_master_add_i3c_dev_locked() is called after a device has already been assigned a dynamic address. If the function fails, the address remains marked as free and may be reallocated to another device, leading to address conflicts on the bus. Ensure the address is not marked as free on failure, by updating the address slot state to prevent the address from being re-used. Emit an error message to inform of the failure. Opportunistically remove the !master check because it is impossible. Note, directly resetting the device's dynamic address is no longer an option, since Direct RSTDAA was deprecated from I3C starting from version 1.1 and v1.1 (or later) target devices are meant to NACK it. Fixes: 3a379bbcea0af ("i3c: Add core I3C infrastructure") Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260612080107.11606-4-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni Signed-off-by: Sasha Levin --- drivers/i3c/master.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index ab89c8ef6ae86f..dd1508455da213 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -2055,12 +2055,11 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master, bool enable_ibi = false; int ret; - if (!master) - return -EINVAL; - newdev = i3c_master_alloc_i3c_dev(master, &info); - if (IS_ERR(newdev)) - return PTR_ERR(newdev); + if (IS_ERR(newdev)) { + ret = PTR_ERR(newdev); + goto err_prevent_addr_reuse; + } ret = i3c_master_attach_i3c_dev(master, newdev); if (ret) @@ -2182,6 +2181,16 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master, err_free_dev: i3c_master_free_i3c_dev(newdev); +err_prevent_addr_reuse: + /* + * Although the device has not been added, the address has been + * assigned. Prevent the address from being used again. + */ + if (i3c_bus_get_addr_slot_status(&master->bus, addr) == I3C_ADDR_SLOT_FREE) + i3c_bus_set_addr_slot_status(&master->bus, addr, I3C_ADDR_SLOT_I3C_DEV); + + dev_err(&master->dev, "Failed to add I3C device at address %u, error %d\n", addr, ret); + return ret; } EXPORT_SYMBOL_GPL(i3c_master_add_i3c_dev_locked); -- 2.53.0