Re: [PATCH 1/2] dmaengine: qcom-gpi: Add I2C High-Speed mode configuration support

[Jyothi Kumar Seerapu <jyothi.seerapu@oss.qualcomm.com>]

On 8/26/2026 2:01 AM, Frank Li wrote:
> [Severity: High]
> When I2C High-Speed mode is used with both set_config and set_config1,
> can this cause an out-of-bounds write to the tre array?
> 
> Looking at struct gpi_desc, the tre array is statically sized by MAX_TRE,
> which is defined as 3:
> 
> #define MAX_TRE 3
> 
> struct gpi_desc {
>          ...
>          struct gpi_tre tre[MAX_TRE];
>          u32 num_tre;
> };
> 
> If we generate CONFIG0, CONFIG1, GO, and DMA TREs, tre_idx will reach 3
> here. Writing to desc->tre[3] would overflow the array and overwrite the
> adjacent num_tre field.
> 
> Later, gpi_prep_slave_sg() sets gpi_desc->num_tre = 4, which would
> overwrite the first 4 bytes of the newly written DMA TRE, potentially
> causing an IOMMU fault or bus error when the hardware attempts the transfer.
> 
> Should MAX_TRE be increased to accommodate the new CONFIG1 TRE?

Thanks Frank Li, you're right — with both set_config and set_config1 
set, we generate 4 TREs (CONFIG0 + CONFIG1 + GO + DMA), which overflows 
the 3-slot tre[] array. Will bump MAX_TRE to 4 in v2.