Re: i3c: master: svc: IBI payload not bounded by max_payload_len

From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Maoyi Xie <maoyixie.tju@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>,
	 Alexandre Belloni <alexandre.belloni@bootlin.com>,
	 linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: Re: i3c: master: svc: IBI payload not bounded by max_payload_len
Date: Tue, 23 Jun 2026 16:36:13 +0200	[thread overview]
Message-ID: <87mrwlmihu.fsf@bootlin.com> (raw)
In-Reply-To: <178220265899.2552261.12288525775100092849@maoyixie.com> (Maoyi Xie's message of "Tue, 23 Jun 2026 16:17:38 +0800")

Hi,

On 23/06/2026 at 16:17:38 +08, Maoyi Xie <maoyixie.tju@gmail.com> wrote:

> Hi all,
>
> I think svc_i3c_master_handle_ibi() in drivers/i3c/master/svc-i3c-master.c
> can write past the IBI slot buffer when a device sends a large IBI payload.
> I would appreciate it if you could let me know whether you agree.
>
> The read loop bounds the slot only by the hardware FIFO size, not by the
> requested max_payload_len.
>
> 	slot->len = 0;
> 	buf = slot->data;
> 	while (SVC_I3C_MSTATUS_RXPEND(...) && slot->len < SVC_I3C_FIFO_SIZE) {
> 		mdatactrl = readl(master->regs + SVC_I3C_MDATACTRL);
> 		count = SVC_I3C_MDATACTRL_RXCOUNT(mdatactrl);
> 		readsb(master->regs + SVC_I3C_MRDATAB, buf, count);
> 		slot->len += count;
> 		buf += count;
> 	}
>
> slot->data points into the IBI pool. i3c_generic_ibi_alloc_pool() sizes each
> slot at max_payload_len. svc_i3c_master_request_ibi() only rejects a
> max_payload_len above SVC_I3C_FIFO_SIZE (16). So a driver can ask for a small
> window, and mctp-i3c asks for 1. count comes from the controller RXCOUNT
> field and can be up to 31. The loop stops at SVC_I3C_FIFO_SIZE, not at the
> window. A device that sends more bytes than the window overruns slot->data
> into the pool.

It is indeed possible. Please send a patch!

Thanks,
Miquèl

-- 
linux-i3c mailing list
linux-i3c@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-i3c