Re: [PATCH 2/3] i3c: set i3c_xfer.actual_len in controller drivers - sashiko-bot

From: sashiko-bot@kernel.org
To: "Meagan Lloyd" <meaganlloyd@linux.microsoft.com>
Cc: linux-i3c@lists.infradead.org, linux-hwmon@vger.kernel.org,
	"Alexandre Belloni" <alexandre.belloni@bootlin.com>,
	Frank.Li@kernel.org
Subject: Re: [PATCH 2/3] i3c: set i3c_xfer.actual_len in controller drivers
Date: Fri, 11 Sep 2026 21:22:02 +0000	[thread overview]
Message-ID: <20260911212203.376CD1F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260911210935.1353126-3-meaganlloyd@linux.microsoft.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The Renesas I3C controller silently ignores all transfer errors and timeouts, always returning success.
--

commit e28c1ae3a51db6eef5fcba16ca850acda1a087d2
Author: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
Subject: i3c: set i3c_xfer.actual_len in controller drivers

This commit updates various I3C controller drivers to set actual_len for
read transfers. It provides a consistent location for device drivers to know
the read response bytes without overriding the length field.

> diff --git a/drivers/i3c/master/renesas-i3c.c b/drivers/i3c/master/renesas-i3c.c
> --- a/drivers/i3c/master/renesas-i3c.c
> +++ b/drivers/i3c/master/renesas-i3c.c
> @@ -918,6 +918,9 @@ static int renesas_i3c_i3c_xfers(struct i3c_dev_desc *dev, struct i3c_xfer *i3c_
>  		time_left = renesas_i3c_wait_xfer(i3c, xfer);
>  		if (!time_left)
>  			xfer_failed = true;
> +
> +		if (i3c_xfers[i].rnw)
> +			i3c_xfers[i].actual_len = cmd->rx_count;
>  	}
>  
>  	if (xfer_failed)
>  		renesas_i3c_irqs_mask_and_clear(i3c);
>  
>  	return 0;
>  }

[Severity: High]
This isn't a bug introduced by this patch, but is a critical pre-existing
issue. Does renesas_i3c_i3c_xfers() silently ignore transfer errors?

If an I3C hardware error occurs during the transfer, the ISR populates
xfer->ret with a negative error code like -EIO, but the loop here never
checks xfer->ret. Furthermore, if a timeout occurs, xfer_failed is set,
but the loop does not break early, and the function unconditionally returns
0 at the end.

Since the controller ignores the error and returns success, callers will
proceed as if the data was successfully read or written. Could this lead
to I3C device drivers consuming uninitialized memory or encountering silent
state machine failures when a hardware NACK, CRC error, or timeout occurs?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911210935.1353126-1-meaganlloyd@linux.microsoft.com?part=2

-- 
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c