Re: [PATCH V2 05/17] i3c: master: Remove stale GETSTATUS length check

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] i3c: GETSTATUS silent success on 0-byte read with amd-i3c-master
--

commit f719c6d08e31060f2440ad1b34f948657af68459
Author: Adrian Hunter <adrian.hunter@intel.com>

    i3c: master: Remove stale GETSTATUS length check

This commit removes an explicit length check in i3c_master_getstatus_locked(),
relying instead on the generic CCC response length validation.

> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index 425b98e6efaaa..c50887b0b37d0 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
> @@ -1777,11 +1777,6 @@ static int i3c_master_getstatus_locked(struct i3c_master_controller *master,
>  	if (ret)
>  		goto out;
>  
> -	if (dest.payload.len != sizeof(*getstatus)) {
> -		ret = -EIO;
> -		goto out;
> -	}
> -
>  	if (status)
>  		*status = be16_to_cpu(getstatus->status);

[Severity: Medium]
Does removing this explicit length check introduce a silent failure on systems
using the amd-i3c-master controller?

When an I3C device terminates a GETSTATUS read with 0 bytes on the
amd-i3c-master controller, the driver incorrectly mutates payload.len to 0
instead of setting actual_len.

The generic validation in i3c_ccc_validate_payload_len() explicitly skips
validation if !p->len, incorrectly returning success. Before this patch, the
explicit length check here safely caught the driver's mutated 0-length and
correctly returned -EIO.

Without this check, the function silently succeeds and reads the zeroed
getstatus->status structure. Can this lead to incorrect behavior on these
systems?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917191356.133242-1-adrian.hunter@intel.com?part=5

-- 
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c