From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1E6FDC55160 for ; Thu, 30 Jul 2026 02:32:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:References:Subject:CC:To:MIME-Version: From:Date:Message-ID:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=JY8NCasPKyjxFg6Dsq++++7+2VApFJeYeqH8sNIeQFI=; b=kJgc2gXDUjxd4mYaWUn6v8ekcy aODJw1508tQqpo84UsflCbULsHHupMBJDwCqpepDjpKpKw9ZnbpkIeVKljXtIThDjasn2WNre3QiO jhMHSlOQcsWuDzmuUQ3dprlAnSXGw5iHG1BPtbajckCFiuWDDuEswigaSXzCxBk/P7sTzticNjBpd rrnQ8Y2edOLmsBY2ut1blFYENjVdxId9TIL8g07PRWG5o6Xni/AhJn6n9/bicuSOXp/g3kaMDwfM0 PfAe7CCkK//lc+h7NM9kNI+t7P7L/m28crBpSu63TC8ZC4pNDHgb2hSat2+isITHyy88aDknEjN4O OAzLXkCA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wpGZk-00000009LzQ-3P9z; Thu, 30 Jul 2026 02:32:48 +0000 Received: from m16.mail.126.com ([220.197.31.8]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wpGZh-00000009Lxe-3ph3 for linux-i3c@lists.infradead.org; Thu, 30 Jul 2026 02:32:47 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=Message-ID:Date:From:MIME-Version:To:Subject: Content-Type; bh=m/T0DHccDvJu8DEt5Dl6kUCV+jlFNpuQHUTsYJoQVhU=; b=AJEUkuASELeboJWDnvW9cnNpAaBreoL4qRUrRMUkO9OF5D+aJWh4GJbiStVx46 P4tSiAi/6vmRJR7jm+POqjeZFkuoLxLLZF7r+jSMz50DQHByiWg0MLBZPbA0lFUU 4PVz0bkOoWut4C+lM8Mr9QpXcPJ8BfzNDJOXLc33B5Ctc= Received: from localhost.localdomain (unknown []) by gzsmtp5 (Coremail) with SMTP id QCkvCgDnD3ymt2pqpKo1EA--.54817S2; Thu, 30 Jul 2026 10:32:06 +0800 (CST) Message-ID: <6A6AB796.1040906@126.com> Date: Thu, 30 Jul 2026 10:31:50 +0800 From: Hongling Zeng User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 To: Mukesh Savaliya , Hongling Zeng , alexandre.belloni@bootlin.com, Frank.Li@nxp.com, amergnat@baylibre.com, tze.yee.ng@altera.com, adrian.ho.yin.ng@altera.com CC: linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] i3c: fix potential NULL dereference in send_ccc_cmd_locked References: <20260728063045.73473-1-zenghongling@kylinos.cn> <5ac5f386-1b95-4b30-a7e2-c246c9bfad68@oss.qualcomm.com> In-Reply-To: <5ac5f386-1b95-4b30-a7e2-c246c9bfad68@oss.qualcomm.com> X-CM-TRANSID: QCkvCgDnD3ymt2pqpKo1EA--.54817S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7AFyrtFyfGr48ArWxJF4kXrb_yoW8WrWfp3 y8Ca10k348tFW8GF42qa13ZayYqwnIq3yrKF43X3ya9FWjyF1ktF1UWw1FvasrXFn5ArWY qryYqa1UuFZ0v37anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07j8J5rUUUUU= X-Originating-IP: [112.64.161.44] X-CM-SenderInfo: x2kr0wpolqwiqxrzqiyswou0bp/xtbBrwdMHWpqt6fzLwAA31 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260729_193246_337145_C02E2093 X-CRM114-Status: GOOD ( 14.90 ) X-BeenThere: linux-i3c@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Sender: "linux-i3c" Errors-To: linux-i3c-bounces+linux-i3c=archiver.kernel.org@lists.infradead.org CuWcqCAyMDI25bm0MDfmnIgyOOaXpSAxODoyNywgTXVrZXNoIFNhdmFsaXlhIOWGmemBkzoKPgo+ Cj4gT24gNy8yOC8yMDI2IDEyOjAwIFBNLCBIb25nbGluZyBaZW5nIHdyb3RlOgo+PiBUaGUgcmV0 cnkgbG9vcCBhZGRlZCBpbiBjb21taXQgMDJjYzgzMjE5MWRkICgiaTNjOiBtYXN0ZXI6IFZhbGlk YXRlIEdFVAo+PiAgIENDQyBwYXlsb2FkIGxlbmd0aCBhbmQgcmV0cnkgRGlyZWN0IEdFVCBvbmNl IikgcmVzZXRzIHBheWxvYWQgCj4+IGFjdHVhbF9sZW4KPj4gYmVmb3JlIGVhY2ggYXR0ZW1wdC4g SG93ZXZlciwgY21kLT5kZXN0cyBpcyBvbmx5IHZhbGlkYXRlZCBmb3IgRElSRUNUCj4+IENDQyBj b21tYW5kcyAoSTNDX0NDQ19ESVJFQ1QgYml0IHNldCkuIEZvciBicm9hZGNhc3QgY29tbWFuZHMs IGRlc3RzCj4+IGNhbiBiZSBOVUxMIHdoaWxlIG5kZXN0cyA+IDAsIGNhdXNpbmcgYSBOVUxMIHBv aW50ZXIgZGVyZWZlcmVuY2UgYXQKPj4gY21kLT5kZXN0c1tpXS5wYXlsb2FkLmFjdHVhbF9sZW4u Cj4+Cj4+IEZpeCBieSByZXN0cmljdGluZyB0aGUgYWN0dWFsX2xlbiByZXNldCB0byBESVJFQ1Qg Y29tbWFuZHMuCj4+Cj4+IEZpeGVzOiAwMmNjODMyMTkxZGQgKCJpM2M6IG1hc3RlcjogVmFsaWRh dGUgR0VUIENDQyBwYXlsb2FkIGxlbmd0aCAKPj4gYW5kIHJldHJ5IERpcmVjdCBHRVQgb25jZSIp Cj4+IFNpZ25lZC1vZmYtYnk6IEhvbmdsaW5nIFplbmcgPHplbmdob25nbGluZ0BreWxpbm9zLmNu Pgo+PiAtLS0KPj4gICBkcml2ZXJzL2kzYy9tYXN0ZXIuYyB8IDIgKy0KPj4gICAxIGZpbGUgY2hh bmdlZCwgMSBpbnNlcnRpb24oKyksIDEgZGVsZXRpb24oLSkKPj4KPj4gZGlmZiAtLWdpdCBhL2Ry aXZlcnMvaTNjL21hc3Rlci5jIGIvZHJpdmVycy9pM2MvbWFzdGVyLmMKPj4gaW5kZXggZmQzZTc5 ZDEwYzg0Li4yMTIxMmMzNGMzMWUgMTAwNjQ0Cj4+IC0tLSBhL2RyaXZlcnMvaTNjL21hc3Rlci5j Cj4+ICsrKyBiL2RyaXZlcnMvaTNjL21hc3Rlci5jCj4+IEBAIC0xMDUxLDcgKzEwNTEsNyBAQCBz dGF0aWMgaW50IAo+PiBpM2NfbWFzdGVyX3NlbmRfY2NjX2NtZF9sb2NrZWQoc3RydWN0IGkzY19t YXN0ZXJfY29udHJvbGxlciAqbWFzdGVyLAo+PiAgICAgICBmb3IgKGF0dGVtcHQgPSAwOyBhdHRl bXB0IDwgbWF4X2F0dGVtcHRzOyBhdHRlbXB0KyspIHsKPj4gICAgICAgICAgIHVuc2lnbmVkIGlu dCBpOwo+PiAgIC0gICAgICAgIGlmIChjbWQtPnJudykKPj4gKyAgICAgICAgaWYgKGNtZC0+cm53 ICYmIChjbWQtPmlkICYgSTNDX0NDQ19ESVJFQ1QpKQo+Cj4gUGxlYXNlIHJldmlldyB0aGlzIHJl Y2VudCBmaXggQAo+IGh0dHBzOi8vbG9yZS5rZXJuZWwub3JnL2FsbC9hbUphdTlMZ2VoWUxuUjIw QGxpemhpLVByZWNpc2lvbi1Ub3dlci01ODEwLwo+CnwKCnxUaGFua3MsIEFkcmlhbidzIGZpeCBt YWtlcyBtb3JlIHNlbnNlIGJ5IHZhbGlkYXRpbmcgdGhlIGlucHV0IGF0IHRoZQplbnRyeSBwb2lu dCByYXRoZXIgdGhhbiBmaXhpbmcgb25seSB0aGUgcmV0cnkgbG9vcCB1c2Ugc2l0ZS58Cgp8Cj4+ ICAgICAgICAgICAgICAgZm9yIChpID0gMDsgaSA8IGNtZC0+bmRlc3RzOyBpKyspCj4+ICAgICAg ICAgICAgICAgICAgIGNtZC0+ZGVzdHNbaV0ucGF5bG9hZC5hY3R1YWxfbGVuID0gMDsKCgotLSAK bGludXgtaTNjIG1haWxpbmcgbGlzdApsaW51eC1pM2NAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRw Oi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWkzYwo= From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from m16.mail.126.com (m16.mail.126.com [117.135.210.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9F8E376BDE for ; Thu, 30 Jul 2026 02:33:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.7 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785378795; cv=none; b=aXpJKH6GxK0V6oGJw3jCBFiKYkYYz34wIKhsWF8YzG4qTeH74MIL9QoWWA+mlsK2YKKR467B6gEreb6CpUU6m8m+0WxuiHV0z+4BWXtVzaNHf3BAq8Zb6vDSJHW2S/Ez2cBmrxieXwvz5PoP1JmbMH65auaRgjvOZ/zeIqwohHc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785378795; c=relaxed/simple; bh=fRWrTTgX70fFAhs6x5luSEhNqyZGScYWTmMjjWiNAUo=; h=Message-ID:Date:From:MIME-Version:To:CC:Subject:References: In-Reply-To:Content-Type; b=pb50tAqmLW9/w/hrh5opy5apEf3t4RVlwlCNt1ZnV7sOp7GiPthumGRq3aaR5FmoXdD96WSDQidEqbLc+Vw/DaHHJl9cLAFqgqQNAjDQr9EDRyZZ4yOVnWOAyN86koFTsV+LlJz/vGJukVCT+JEvGOg+5OANYXqh3/jG07/TNBs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=AJEUkuAS; arc=none smtp.client-ip=117.135.210.7 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="AJEUkuAS" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=Message-ID:Date:From:MIME-Version:To:Subject: Content-Type; bh=m/T0DHccDvJu8DEt5Dl6kUCV+jlFNpuQHUTsYJoQVhU=; b=AJEUkuASELeboJWDnvW9cnNpAaBreoL4qRUrRMUkO9OF5D+aJWh4GJbiStVx46 P4tSiAi/6vmRJR7jm+POqjeZFkuoLxLLZF7r+jSMz50DQHByiWg0MLBZPbA0lFUU 4PVz0bkOoWut4C+lM8Mr9QpXcPJ8BfzNDJOXLc33B5Ctc= Received: from localhost.localdomain (unknown []) by gzsmtp5 (Coremail) with SMTP id QCkvCgDnD3ymt2pqpKo1EA--.54817S2; Thu, 30 Jul 2026 10:32:06 +0800 (CST) Message-ID: <6A6AB796.1040906@126.com> Date: Thu, 30 Jul 2026 10:31:50 +0800 From: Hongling Zeng User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 To: Mukesh Savaliya , Hongling Zeng , alexandre.belloni@bootlin.com, Frank.Li@nxp.com, amergnat@baylibre.com, tze.yee.ng@altera.com, adrian.ho.yin.ng@altera.com CC: linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] i3c: fix potential NULL dereference in send_ccc_cmd_locked References: <20260728063045.73473-1-zenghongling@kylinos.cn> <5ac5f386-1b95-4b30-a7e2-c246c9bfad68@oss.qualcomm.com> In-Reply-To: <5ac5f386-1b95-4b30-a7e2-c246c9bfad68@oss.qualcomm.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-CM-TRANSID:QCkvCgDnD3ymt2pqpKo1EA--.54817S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7AFyrtFyfGr48ArWxJF4kXrb_yoW8WrWfp3 y8Ca10k348tFW8GF42qa13ZayYqwnIq3yrKF43X3ya9FWjyF1ktF1UWw1FvasrXFn5ArWY qryYqa1UuFZ0v37anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07j8J5rUUUUU= X-CM-SenderInfo: x2kr0wpolqwiqxrzqiyswou0bp/xtbBrwdMHWpqt6fzLwAA31 在 2026年07月28日 18:27, Mukesh Savaliya 写道: > > > On 7/28/2026 12:00 PM, Hongling Zeng wrote: >> The retry loop added in commit 02cc832191dd ("i3c: master: Validate GET >> CCC payload length and retry Direct GET once") resets payload >> actual_len >> before each attempt. However, cmd->dests is only validated for DIRECT >> CCC commands (I3C_CCC_DIRECT bit set). For broadcast commands, dests >> can be NULL while ndests > 0, causing a NULL pointer dereference at >> cmd->dests[i].payload.actual_len. >> >> Fix by restricting the actual_len reset to DIRECT commands. >> >> Fixes: 02cc832191dd ("i3c: master: Validate GET CCC payload length >> and retry Direct GET once") >> Signed-off-by: Hongling Zeng >> --- >> drivers/i3c/master.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c >> index fd3e79d10c84..21212c34c31e 100644 >> --- a/drivers/i3c/master.c >> +++ b/drivers/i3c/master.c >> @@ -1051,7 +1051,7 @@ static int >> i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, >> for (attempt = 0; attempt < max_attempts; attempt++) { >> unsigned int i; >> - if (cmd->rnw) >> + if (cmd->rnw && (cmd->id & I3C_CCC_DIRECT)) > > Please review this recent fix @ > https://lore.kernel.org/all/amJau9LgehYLnR20@lizhi-Precision-Tower-5810/ > | |Thanks, Adrian's fix makes more sense by validating the input at the entry point rather than fixing only the retry loop use site.| | >> for (i = 0; i < cmd->ndests; i++) >> cmd->dests[i].payload.actual_len = 0;