Re: [PATCH 2/2] i2c: qcom-geni: Add support for I2C High-Speed mode

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing I2C_HS_WRITE checks in geni_i2c_gpi() cause unintended TX DMA mapping for read messages and out-of-bounds array accesses.
--

--- Patch [2]: [PATCH 2/2] i2c: qcom-geni: Add support for I2C High-Speed mode ---
commit 010ffaa50c8bd9bb0e57a40b999e343cea742bb8
Author: Jyothi Kumar Seerapu <jyothi.seerapu@oss.qualcomm.com>

i2c: qcom-geni: Add support for I2C High-Speed mode

Implement I2C High-Speed (HS) mode for the Qualcomm GENI I2C controller.
Detect HS mode requests based on 3.4 MHz frequency and configure the
hardware accordingly.

> diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
> index 658636c1ee0e2..3712e0dd9e68d 100644
> --- a/drivers/i2c/busses/i2c-qcom-geni.c
> +++ b/drivers/i2c/busses/i2c-qcom-geni.c
[ ... ]
> @@ -700,7 +756,7 @@ static int geni_i2c_gpi(struct geni_i2c_dev *gi2c, struct i2c_msg msgs[],
>  		goto out;
>  	}
>  
> -	if (op == I2C_WRITE)
> +	if (op == I2C_WRITE || op == I2C_HS_WRITE)
>  		map_dirn = DMA_TO_DEVICE;
>  	else
>  		map_dirn = DMA_FROM_DEVICE;

[Severity: High]
Will this cause unintended TX DMA mapping and out-of-bounds array accesses
for High-Speed mode read messages?

It looks like op == I2C_HS_WRITE was added here for map_dirn, but it wasn't
added to the check that skips TX DMA mapping for read messages earlier in
this function:

    if (op == I2C_WRITE && msgs[msg_idx].flags & I2C_M_RD) {
            peripheral->multi_msg = true;
            goto skip_tx_dma_map;
    }

Because I2C_HS_WRITE isn't checked here, High-Speed reads will fail to skip
the TX DMA mapping.

Additionally, it appears the same omission happens later in the function
when incrementing msg_idx_cnt:

    if (!((msgs[msg_idx].flags & I2C_M_RD) && op == I2C_WRITE))
            gi2c_gpi_xfer->msg_idx_cnt++;

Since I2C_HS_WRITE is missing, the counter will be prematurely incremented
for HS reads. When the subsequent RX call processes the read message with
I2C_HS_READ, it will use the incremented msg_idx_cnt, potentially pointing
out of bounds of the msgs array.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824-i2c-hs-v1-0-8dd94e5c6113@oss.qualcomm.com?part=2