i3c: harden device index and detach handling
Subsystems (2)
cover i3c: harden device index and detach handling
From: Alif Zakuan Yuslaimi <[email protected]>
The DesignWare I3C master indexes master->i3cdev[] for transfers and listing without checking for an out-of-range or empty slot. A bad device number or a detached DAT entry can therefore NULL-dereference.
This series rejects invalid indices on read/write, clears the i3cdev[] slot on detach (leaving num_i3cdevs unchanged), and skips NULL slots when the i3c command lists devices. Also drop unused includes from cmd/i3c.c.
Alif Zakuan Yuslaimi (2):
i3c: dw: validate device index and clear slot on detach
cmd: i3c: drop unused includes and skip empty device slots
cmd/i3c.c | 18 +++++++----------- drivers/i3c/master/dw-i3c-master.c | 15 +++++++++++++-- 2 files changed, 20 insertions(+), 13 deletions(-)
Signature · 1 line
2.43.7
PATCH RESEND 1/2 i3c: dw: validate device index and clear slot on detach
From: Alif Zakuan Yuslaimi <[email protected]>
dm_i3c_read/write indexed master->i3cdev[] without checking the device number or a NULL slot, which can crash on a bad index. Reject out-of- range and empty slots with -EINVAL.
On detach, clear the matching i3cdev[] entry so a later transfer cannot reuse a stale descriptor pointer. Leave num_i3cdevs unchanged so the existing dense listing path keeps its prior meaning.
--- drivers/i3c/master/dw-i3c-master.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/i3c/master/dw-i3c-master.c +13 -2
@@ -826,6 +826,7 @@ static void dw_i3c_master_detach_i3c_dev(struct i3c_dev_desc *dev) DEV_ADDR_TABLE_LOC(master->datstartaddr, data->index));i3c_dev_set_master_data (dev,NULL ); + master->i3cdev[data->index] =NULL ; master->addrs[data->index] =0 ; master->free_pos |=BIT (data->index);kfree (data);
@@ -1014,9 +1015,14 @@ static int dw_i3c_master_priv_read(struct udevice *dev, u32 dev_number, u8 *buf, u32 buf_size) {struct dw_i3c_master *master =dev_get_priv (dev); -struct i3c_dev_desc *i3cdev = master->i3cdev[dev_number]; +struct i3c_dev_desc *i3cdev;struct i3c_priv_xfer i3c_xfers; +if (dev_number >=ARRAY_SIZE (master->i3cdev) || + !master->i3cdev[dev_number]) +return -EINVAL ; + + i3cdev = master->i3cdev[dev_number]; i3c_xfers.data.in = buf; i3c_xfers.len = buf_size; i3c_xfers.rnw =I3C_MSG_READ ;
@@ -1028,9 +1034,14 @@ static int dw_i3c_master_priv_write(struct udevice *dev, u32 dev_number, u8 *buf, u32 buf_size) {struct dw_i3c_master *master =dev_get_priv (dev); -struct i3c_dev_desc *i3cdev = master->i3cdev[dev_number]; +struct i3c_dev_desc *i3cdev;struct i3c_priv_xfer i3c_xfers; +if (dev_number >=ARRAY_SIZE (master->i3cdev) || + !master->i3cdev[dev_number]) +return -EINVAL ; + + i3cdev = master->i3cdev[dev_number]; i3c_xfers.data.out = buf; i3c_xfers.len = buf_size; i3c_xfers.rnw =I3C_MSG_WRITE ;
Signature · 1 line
2.43.7
Re: [resend 1/2] i3c: dw: validate device index and clear slot on detach
Hello Alif,
Quoted 6 lines · On 06.11.26 04:18, [email protected] wrote:
From: Alif Zakuan Yuslaimi <[email protected]>
dm_i3c_read/write indexed master->i3cdev[] without checking the device number or a NULL slot, which can crash on a bad index. Reject out-of- range and empty slots with
-EINVAL.
Quoted 8 lines
On detach, clear the matching i3cdev[] entry so a later transfer cannot reuse a stale descriptor pointer. Leave
num_i3cdevsunchanged so the existing dense listing path keeps its prior meaning.Signed-off-by Alif Zakuan Yuslaimi <[email protected]>--- drivers/i3c/master/dw-i3c-master.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
@Dinesh: The patch is applied to me in patchwork, can I move it to you? (Please send me your patchwork username, thanks!)
bye,
Heiko
Signature · 5 lines
Nabla Software Engineering HRB 40522 Augsburg Phone: +49 821 45592596 E-Mail: [email protected] Geschäftsführer : Stefano Babic
PATCH RESEND 2/2 cmd: i3c: drop unused includes and skip empty device slots
In reply to [email protected]From: Alif Zakuan Yuslaimi <[email protected]>
Remove headers that the command does not use, and skip NULL i3cdev entries when listing devices so a detached DAT slot cannot fault.
--- cmd/i3c.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-)
cmd/i3c.c +7 -11
@@ -3,23 +3,14 @@* Copyright (C) 2025 Altera Corporation <www.altera.com> */ -#include <bootretry.h> -#include <cli.h> #include <command.h> -#include <console.h> #include <dm.h> #include <dw-i3c.h> -#include <edid.h> #include <errno.h> #include <hexdump.h> -#include <log.h> #include <malloc.h> -#include <asm/byteorder.h> -#include <linux/compiler.h> -#include <linux/delay.h> -#include <u-boot/crc.h> +#include <string.h> #include <linux/i3c/master.h> -#include <linux/printk.h> #include <linux/types.h> static struct udevice *currdev;
@@ -103,7 +94,12 @@ static int handle_i3c_device_list(void) }for (int i =0 ; i < master->num_i3cdevs; i++) { -struct i3c_device_info *info = &master->i3cdev[i]->info; +struct i3c_device_info *info; + +if (!master->i3cdev[i]) +continue ; + + info = &master->i3cdev[i]->info;printf ("Device %d:\n" , i);printf (" Static Address : 0x%02X\n" , info->static_addr);
Signature · 1 line
2.43.7
Re: [resend 2/2] cmd: i3c: drop unused includes and skip empty device slots
Hello Alif,
Quoted 9 lines · On 06.11.26 04:18, [email protected] wrote:
From: Alif Zakuan Yuslaimi <[email protected]>
Remove headers that the command does not use, and skip NULL i3cdev entries when listing devices so a detached DAT slot cannot fault.
Signed-off-by Alif Zakuan Yuslaimi <[email protected]>--- cmd/i3c.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-)
@Dinesh: The patch is applied to me in patchwork, can I move it to you? (Please send me your patchwork username, thanks!)
bye,
Heiko
Signature · 5 lines
Nabla Software Engineering HRB 40522 Augsburg Phone: +49 821 45592596 E-Mail: [email protected] Geschäftsführer : Stefano Babic