From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 999D519DF62 for ; Tue, 28 Jul 2026 10:27:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785234474; cv=none; b=KnbfmHdPrqQEFkmxZDnIT5LFJovyINQK9TehoipiOaMXPaEP5hrkr0pUMA7mHLEao7tpcZXONFAkQK1oTQrql4chD6pf3fLUy3sNH1nq+KkRdq/aQmbQooY6FuXdd/IIXccRw7v3xt3HUI1sAgJ4IrV5a45wjTdTX7RwUSGGDDI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785234474; c=relaxed/simple; bh=HdVHupPikY5ZFW0kX9CCzyR7yS4nm1pWmpI2uGUkFJo=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=oWrY9LHEQPcndCDtS2JD2sCfh9h7cf12qnM/ZU/nCElrwy40MIWp2gqW7+EgjwChksHlf8eWh0a3f7vbG5KUO27mcwvPRqL0nw5vDeA/b2wHwctvO5ecRV599b20P8ajzEeSG4xudUT7ALE0MvRaykvj0Gq2kMQOKUIrzTFFglk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=ZpspQz/L; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=IlxnHSW5; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="ZpspQz/L"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="IlxnHSW5" Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66S82FDS2480199 for ; Tue, 28 Jul 2026 10:27:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= KleGeYc/s77Xun7ZdkDiAPcyMV9ltHnmw51PhQU7z3M=; b=ZpspQz/LZJZVFEAI ePEDC0vlftVl9JNRocuCSiKbYnLSLW4qQ+vxM+XkYAcsUhMBYMHLDMBynzuEQB3i WogoFm/Wf11Rsws4mUjxf/GEhXrm5qA7iME/nmF2EbVjYrOnRvzmzY9OCPObuucI /nUYbN3tglL6WTb4WPStgfX6Uu93iTPWgxnY2VE19m9tg7RMK+5Q7kFWmk+Or+1f FC8zQhzhUyqXgde7ygwEfwSHC6fSnv7br4OKPTdcHm0ToVNRP7VxVV6xTJT2iVGO bEDUtVutDZF2CDtV8zCRNEEfDQ+IIERdeMV+tazXKfpgzsbFdNXb2RsDaV1cvZkL 1jCBxQ== Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fpmy11fv7-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 28 Jul 2026 10:27:52 +0000 (GMT) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2cfa55c9430so36065435ad.0 for ; Tue, 28 Jul 2026 03:27:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1785234472; x=1785839272; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KleGeYc/s77Xun7ZdkDiAPcyMV9ltHnmw51PhQU7z3M=; b=IlxnHSW5/46N8N5yQMbKVie0a0O6fIN9E3m9N+plcqcDGnKIN5kjFBfIp2w8odrTZe j2w9Fd4spHbyQ7FvYPn0F53Bvntx4itkJHBmZWmYN9kyFNSs9SaOzZIkNyU6VZW/dvlF imoqw5F0c9uq4Um5fJyhSMrhNlABGAIOKnH6piGmwBqH2fiQRzGP7RUl6DpM7OXpfb97 d+R7RZzl7rIoIhka22jSnhgrrT96eloE+WFkVMRC8Ywh7Mb7YIZeb9G8EmMcXjfrsQ1m 7avY+4UJuqZ6LPgTP7g+U3FGq+GoGtpkvpns0BHDixiWk7Ch0Z+IaY2k5HAL94A2OQ1Z 1F1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785234472; x=1785839272; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KleGeYc/s77Xun7ZdkDiAPcyMV9ltHnmw51PhQU7z3M=; b=XPPxNowFXx66xNHff2EBAwQ2MKRVsvDXnOir+8slBIOwzIBaJtXLXJ9vhUSONU7s7F f1EIT78UZbRcQ8kCguQ5VoVHUDl+C5mld8wEpVm9rjjY0ltCbv/s3skQMFhMSBjOEql2 iDd6BreSYRsrTIUA9Rz5V9VTGN1FqNM94ivpSgKR/aY7Ej54gPjxptNeQA4qWMBw9upt flpwPzSzIaBHmUuXoZXkt4z7CPIAar6znNpJLEMEuckKpO7CclrEf13b8Hs7h1pJRkXM fPJziaYI4fw5bDWDjajaSRSGD8M6sAqQ2fK3CWRnF0BvOC8opMoz20kMVWlDDIf2SItP cJsw== X-Forwarded-Encrypted: i=1; AHgh+Rq2fc1qGMIxSKulCI6wCUCwdFkQK4Z6OYneWFGqwNEehSruPgU/8aImuFR7GsQlftikg++UHx6Nwlj/Rdk=@vger.kernel.org X-Gm-Message-State: AOJu0Yyhi0DmLxGWOX7PYr8JJVB8KixLCenT9OjvT7bVoJdyiACydh4c 1VR0pKXVDjL0EspUYymVrSAuCIGywe8H5jn7N2L7AeZJtviXfqtrIqzJiKYVERTAzRjSnvSuH8e frlYuy8RqElvxlQueq5nubbBSLtDzdnJV1v9q12Qbxpo9s0zsCfc1hqsu/jkO+GexoTs= X-Gm-Gg: AR+sD11Aw0pfMKWqFzv+IWKPupPhE+bdN5e+xd3IDkxZazUpEKHorOtVrwOC9f9uhap HEMbUZnzXlgglyJ+C++S+qI9iK1Wv5gY7waqurhSvhaYn5f1N+APJxnThVnBoSbnfHGqUsJtErU 0tcKZCBxp+pLPXHA1ng0lxH1+2wQfi2UHJUzrqVhsxkwk/uAJq4Zjc7xcfcVwLR751Dxx2hSMrf kNWZ4rX+5PQXcKtiLV5IcmZtjfAz/9nsLBwWdMM8lMJIrOHmcRkHakellSgkGq6YJi8X+w8s8WG A/aUYx/YziDDQHk53tLIMmiUGSE8V4p2Zbz24YaaBrSqmvOnORm7/3vmDTxnAHQ9Fsd0Gkbl7Wi Amhxw+nr/MELzasHi1q3PeJ/MVxGnhiSLrQ== X-Received: by 2002:a17:903:230f:b0:2cf:83bf:6b05 with SMTP id d9443c01a7336-2d015d7e6d2mr20766135ad.41.1785234472401; Tue, 28 Jul 2026 03:27:52 -0700 (PDT) X-Received: by 2002:a17:903:230f:b0:2cf:83bf:6b05 with SMTP id d9443c01a7336-2d015d7e6d2mr20765855ad.41.1785234471982; Tue, 28 Jul 2026 03:27:51 -0700 (PDT) Received: from [10.217.219.72] ([202.46.22.19]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cfde5e26e9sm50744115ad.23.2026.07.28.03.27.48 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 28 Jul 2026 03:27:51 -0700 (PDT) Message-ID: <5ac5f386-1b95-4b30-a7e2-c246c9bfad68@oss.qualcomm.com> Date: Tue, 28 Jul 2026 15:57:46 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] i3c: fix potential NULL dereference in send_ccc_cmd_locked To: Hongling Zeng , alexandre.belloni@bootlin.com, Frank.Li@nxp.com, amergnat@baylibre.com, tze.yee.ng@altera.com, adrian.ho.yin.ng@altera.com Cc: linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org, zhongling0719@126.com References: <20260728063045.73473-1-zenghongling@kylinos.cn> Content-Language: en-US From: Mukesh Savaliya In-Reply-To: <20260728063045.73473-1-zenghongling@kylinos.cn> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Proofpoint-GUID: IaTYkx9KSQKXmnNjzK5HUKufNGlmTBKh X-Proofpoint-ORIG-GUID: IaTYkx9KSQKXmnNjzK5HUKufNGlmTBKh X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI4MDA5MSBTYWx0ZWRfX2U7SX+L4XIRY nomfXsWfZdswqTKy0Upjxq2A2pR4536LcC2eVwy9+LnmIkFoNE52SRtN9kmB8BnrXP3QtneSDsq jQGnoZvDqrXXhkUruZ4TuQJcG37efXVDenNT9GzP4NoKeOhetroqF0BW8cZc7xAcAMsXiP5WEHI 6wBeJiuHkUXYH5XTUApecGSOMgRTgrgoe8We1p1kq2Dt1sKEUkbC1SY7w/jP9OrqaKrLW3L10B0 nAHpriZfxXZVq8lszczlGKA11ndD1aosymhtNZSh4W3xqeG/KW6i1vQNdF7xbJJFrZyWbzcLhN1 JEezAkuJhKawq4848uQAcka0zLQoEC+Gm++MKVfr+hWGCoctGepwDMKaG3c/X+jNSqQsLZfd0KQ gS5RuZMHbNc0G1QqBO2yLn6FPt58Ee7MCaTCmsJKPVSMpt4snTRIIkLtnvFPMhKhxKhRBiBHh3h Ryqpaz3Ea6Jub6dUlYA== X-Authority-Analysis: v=2.4 cv=PJo/P/qC c=1 sm=1 tr=0 ts=6a688428 cx=c_pps a=IZJwPbhc+fLeJZngyXXI0A==:117 a=fChuTYTh2wq5r3m49p7fHw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=Um2Pa8k9VHT-vaBCBUpS:22 a=VwQbUJbxAAAA:8 a=8rwow83gy2NtHbje-wsA:9 a=QEXdDO2ut3YA:10 a=uG9DUKGECoFWVXl0Dc02:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI4MDA5MSBTYWx0ZWRfXzqgfSXh5yrt0 XY9zqPkHMpG7mwNbofipUQBCtgNvX37llA4/uuOLpMNjQARBhRsUujxJN58j2ZIPp0JAW0v30xB JbEp5NEr9wr/h6vqIgu/DSQZc74Q53g= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-28_02,2026-07-27_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 priorityscore=1501 malwarescore=0 adultscore=0 suspectscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607280091 On 7/28/2026 12:00 PM, Hongling Zeng wrote: > The retry loop added in commit 02cc832191dd ("i3c: master: Validate GET > CCC payload length and retry Direct GET once") resets payload actual_len > before each attempt. However, cmd->dests is only validated for DIRECT > CCC commands (I3C_CCC_DIRECT bit set). For broadcast commands, dests > can be NULL while ndests > 0, causing a NULL pointer dereference at > cmd->dests[i].payload.actual_len. > > Fix by restricting the actual_len reset to DIRECT commands. > > Fixes: 02cc832191dd ("i3c: master: Validate GET CCC payload length and retry Direct GET once") > Signed-off-by: Hongling Zeng > --- > drivers/i3c/master.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c > index fd3e79d10c84..21212c34c31e 100644 > --- a/drivers/i3c/master.c > +++ b/drivers/i3c/master.c > @@ -1051,7 +1051,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, > for (attempt = 0; attempt < max_attempts; attempt++) { > unsigned int i; > > - if (cmd->rnw) > + if (cmd->rnw && (cmd->id & I3C_CCC_DIRECT)) Please review this recent fix @ https://lore.kernel.org/all/amJau9LgehYLnR20@lizhi-Precision-Tower-5810/ > for (i = 0; i < cmd->ndests; i++) > cmd->dests[i].payload.actual_len = 0; >