From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 542F13D25C0; Fri, 22 May 2026 10:18:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779445106; cv=none; b=bVMpUySTsHApvZKbd/bWCBzLXj5dcVxjhRCGO00cQWnjmbgpJoD1E5/lsaxjFsMA2IKZNW4vsx46FWBGB0BJ9FeWEYL47odhaCYyfh4s/8eUn5q+jOAMiiw7d4HtDiC8RdsII77ayVmcfIb2p45amrSghbcGhcIs0FCdMlPP7wU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779445106; c=relaxed/simple; bh=9PKlfJsF/AxORq/IuH3S75bzvw56fX4Ng5OOi276b+c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AzJM204Ya1sdb3GmLro1j0FeTLe4z2Uaj9+pwtiRYhDJAnCH+e5kZ6vqwAV+01RtLNAcSwbRR6mGN1OpPjTdyo+SMg10AtMruNTZurEhjLFXpm2kKKuoCOvOX6aSu5Mc705DxOtkVqJUMHvxQwPj7eksoJjSdRQejbxSBQA70NI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=jVC9Nrpa; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="jVC9Nrpa" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A1D61F00ADE; Fri, 22 May 2026 10:18:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779445105; bh=N6Yc39X/4veC5J+8erpunKoVVlC+FuQ18yNeUE2JwLw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jVC9NrpalTn7f3YOXQ1lobtn+LyQGxi8uCSwmMo2t4tzbYnCO3sDAIh9v0iTFmF3Q JtINr5KHf+5iAgEMCiXTYhHCYFXjTCsaou3FwYZS0mVBCIZU4PfVSHr8nHm0Sto9bo tUYR7eRu50OiBZ8jUtjYf/uAWPebBgpDy7YD41J4HpOfoKleCjcNdZ+p2FDxldjOAI BrbKJ9VBCF87wCF3CAtxZIA8XY0QHkTi+788yF5HknQ6UXWj7zLveflxPzwYNrQYxT 3lC289XnGAMew0QrK9I97F35beaNpkP8N54Xo8Jnq/mjqrwIzODIqXZ4wt9SlC5WFZ UArUFUTFie/4Q== From: Claudiu Beznea To: wsa+renesas@sang-engineering.com, tommaso.merciai.xr@bp.renesas.com, alexandre.belloni@bootlin.com, Frank.Li@nxp.com, p.zabel@pengutronix.de Cc: claudiu.beznea@kernel.org, claudiu.beznea@tuxon.dev, linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org, linux-renesas-soc@vger.kernel.org, Claudiu Beznea , stable@vger.kernel.org Subject: [PATCH 01/17] i3c: renesas: Check that the transfer is valid before accessing it Date: Fri, 22 May 2026 13:17:59 +0300 Message-ID: <20260522101815.1722909-2-claudiu.beznea@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260522101815.1722909-1-claudiu.beznea@kernel.org> References: <20260522101815.1722909-1-claudiu.beznea@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Claudiu Beznea The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion. The interrupt handler dequeues the transfer, updates/uses it, and signals the waiting thread. If the completion times out, the waiting thread dequeues the transfer and free it. If an interrupt fires after that, the handler may access freed memory, leading to crashes. Check that the transfer is still valid before accessing it in the interrupt handler. Fixes: d028219a9f14 ("i3c: master: Add basic driver for the Renesas I3C controller") Cc: stable@vger.kernel.org Signed-off-by: Claudiu Beznea --- drivers/i3c/master/renesas-i3c.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/i3c/master/renesas-i3c.c b/drivers/i3c/master/renesas-i3c.c index f39c449922ca..36e3ccbe66b0 100644 --- a/drivers/i3c/master/renesas-i3c.c +++ b/drivers/i3c/master/renesas-i3c.c @@ -1014,6 +1014,9 @@ static irqreturn_t renesas_i3c_tx_isr(int irq, void *data) scoped_guard(spinlock, &i3c->xferqueue.lock) { xfer = i3c->xferqueue.cur; + if (!xfer) + return IRQ_HANDLED; + cmd = xfer->cmds; if (xfer->is_i2c_xfer) { @@ -1054,6 +1057,9 @@ static irqreturn_t renesas_i3c_resp_isr(int irq, void *data) scoped_guard(spinlock, &i3c->xferqueue.lock) { xfer = i3c->xferqueue.cur; + if (!xfer) + return IRQ_HANDLED; + cmd = xfer->cmds; /* Clear the Respone Queue Full status flag*/ @@ -1138,6 +1144,9 @@ static irqreturn_t renesas_i3c_tend_isr(int irq, void *data) scoped_guard(spinlock, &i3c->xferqueue.lock) { xfer = i3c->xferqueue.cur; + if (!xfer) + return IRQ_HANDLED; + cmd = xfer->cmds; if (xfer->is_i2c_xfer) { @@ -1184,6 +1193,9 @@ static irqreturn_t renesas_i3c_rx_isr(int irq, void *data) scoped_guard(spinlock, &i3c->xferqueue.lock) { xfer = i3c->xferqueue.cur; + if (!xfer) + return IRQ_HANDLED; + cmd = xfer->cmds; if (xfer->is_i2c_xfer) { @@ -1235,6 +1247,8 @@ static irqreturn_t renesas_i3c_stop_isr(int irq, void *data) scoped_guard(spinlock, &i3c->xferqueue.lock) { xfer = i3c->xferqueue.cur; + if (!xfer) + return IRQ_HANDLED; /* read back registers to confirm writes have fully propagated */ renesas_writel(i3c->regs, BST, 0); @@ -1259,6 +1273,9 @@ static irqreturn_t renesas_i3c_start_isr(int irq, void *data) scoped_guard(spinlock, &i3c->xferqueue.lock) { xfer = i3c->xferqueue.cur; + if (!xfer) + return IRQ_HANDLED; + cmd = xfer->cmds; if (xfer->is_i2c_xfer) { -- 2.43.0