From: Jakub Kicinski <kuba@kernel.org>
To: Frank Li <Frank.li@oss.nxp.com>
Cc: linux-i3c@lists.infradead.org, alexandre.belloni@bootlin.com,
Frank.Li@nxp.com, adrianhoyin.ng@altera.com, ustc.gu@gmail.com,
bbrezillon@kernel.org, vitor.soares@synopsys.com
Subject: Re: [PATCH v2] i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
Date: Wed, 1 Jul 2026 11:30:43 -0700 [thread overview]
Message-ID: <20260701113043.726e0e86@kernel.org> (raw)
In-Reply-To: <akVcAZzT-WGHZNWp@lizhi-Precision-Tower-5810>
On Wed, 1 Jul 2026 14:27:13 -0400 Frank Li wrote:
> On Tue, Jun 30, 2026 at 10:29:04AM -0700, Jakub Kicinski wrote:
> > On an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count
> > of addresses left unassigned) equals master->maxdevs.
> >
> > The GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1,
> > which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD
> > server:
> >
> > UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12
> > shift exponent 64 is too large for 64-bit type 'long unsigned int'
> > CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy)
> > Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026
> > Call Trace:
> > <TASK>
> > dump_stack_lvl+0x5d/0x80
> > ubsan_epilogue+0x5/0x2b
> > __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab
> > dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master]
> > i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c]
> >
> > Skip the mask when no new device was assigned.
> >
> > Fixes: 1dd728f5d4d4 ("i3c: master: Add driver for Synopsys DesignWare IP")
> > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> > ---
> Next time add change log here.
My bad, I guess slipped my mind since there were no changes of any real
significance :/
v2:
- whitespace changes
- s/We see this/This happens/ in the commit message
v1: https://lore.kernel.org/20260629233650.2148827-1-kuba@kernel.org/
--
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c
next prev parent reply other threads:[~2026-07-01 18:30 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-30 17:29 [PATCH v2] i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices Jakub Kicinski
2026-07-01 18:27 ` Frank Li
2026-07-01 18:30 ` Jakub Kicinski [this message]
2026-07-05 21:34 ` Alexandre Belloni
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260701113043.726e0e86@kernel.org \
--to=kuba@kernel.org \
--cc=Frank.Li@nxp.com \
--cc=Frank.li@oss.nxp.com \
--cc=adrianhoyin.ng@altera.com \
--cc=alexandre.belloni@bootlin.com \
--cc=bbrezillon@kernel.org \
--cc=linux-i3c@lists.infradead.org \
--cc=ustc.gu@gmail.com \
--cc=vitor.soares@synopsys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox