Re: [PATCH v16 1/8] i3c: master: Add APIs for I3C hub support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Failure in i3c_bus_init() causes i3c_masterdev_release() to erroneously remove ID 0 from the IDR.
--

commit 1f089e3141f5a635df33d2273d7de2114b2f6ef5
Author: Aman Kumar Pandey <aman.kumarpandey@nxp.com>

    i3c: master: Add APIs for I3C hub support
    
    Add CCC helpers to check CCC support and send CCC commands, address slot
    helpers to query and update I3C bus address slot state, registering virtual
    masters with an explicit firmware node, and exposing the bus maintenance
    lock helpers.

> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index f1be38a640ca1..03fb41f0786c5 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c

[ ... ]

> @@ -3195,34 +3267,31 @@ static int i3c_master_check_ops(const struct i3c_master_controller_ops *ops)
>  }
>  
>  /**
> - * i3c_master_register() - register an I3C master
> + * i3c_master_register_fwnode() - register an I3C master with a custom fwnode
>   * @master: master used to send frames on the bus
> - * @parent: the parent device (the one that provides this I3C master
> - *	    controller)
> + * @parent: the parent device providing this I3C master controller
> + * @fwnode: firmware node describing this I3C bus, or NULL
>   * @ops: the master controller operations
> - * @secondary: true if you are registering a secondary master. Will return
> - *	       -EOPNOTSUPP if set to true since secondary masters are not yet
> - *	       supported
> + * @secondary: true if registering a secondary master

[ ... ]

> @@ -3352,6 +3427,39 @@ int i3c_master_register(struct i3c_master_controller *master,
>  
>  	return ret;
>  }
> +EXPORT_SYMBOL_GPL(i3c_master_register_fwnode);

[Severity: High]
This is a pre-existing issue, but can a failure in i3c_bus_init() cause
i3c_masterdev_release() to erroneously remove ID 0 from the IDR?

If idr_alloc() fails in i3c_bus_init(), i3cbus->id remains 0. The error
path in i3c_master_register_fwnode() branches to err_put_dev, calling
put_device(), which invokes i3c_masterdev_release() and unconditionally
calls i3c_bus_cleanup().

This executes idr_remove(&i3c_bus_idr, 0), removing whatever valid bus
happens to own ID 0. This corrupts the IDR, breaking bus lookups for bus 0
and potentially leading to a use-after-free or a double allocation of ID 0
later.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826103819.1614843-1-lakshay.piplani@nxp.com?part=1