From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from m16.mail.126.com (m16.mail.126.com [117.135.210.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9F8E376BDE for ; Thu, 30 Jul 2026 02:33:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.7 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785378795; cv=none; b=aXpJKH6GxK0V6oGJw3jCBFiKYkYYz34wIKhsWF8YzG4qTeH74MIL9QoWWA+mlsK2YKKR467B6gEreb6CpUU6m8m+0WxuiHV0z+4BWXtVzaNHf3BAq8Zb6vDSJHW2S/Ez2cBmrxieXwvz5PoP1JmbMH65auaRgjvOZ/zeIqwohHc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785378795; c=relaxed/simple; bh=fRWrTTgX70fFAhs6x5luSEhNqyZGScYWTmMjjWiNAUo=; h=Message-ID:Date:From:MIME-Version:To:CC:Subject:References: In-Reply-To:Content-Type; b=pb50tAqmLW9/w/hrh5opy5apEf3t4RVlwlCNt1ZnV7sOp7GiPthumGRq3aaR5FmoXdD96WSDQidEqbLc+Vw/DaHHJl9cLAFqgqQNAjDQr9EDRyZZ4yOVnWOAyN86koFTsV+LlJz/vGJukVCT+JEvGOg+5OANYXqh3/jG07/TNBs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=AJEUkuAS; arc=none smtp.client-ip=117.135.210.7 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="AJEUkuAS" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=Message-ID:Date:From:MIME-Version:To:Subject: Content-Type; bh=m/T0DHccDvJu8DEt5Dl6kUCV+jlFNpuQHUTsYJoQVhU=; b=AJEUkuASELeboJWDnvW9cnNpAaBreoL4qRUrRMUkO9OF5D+aJWh4GJbiStVx46 P4tSiAi/6vmRJR7jm+POqjeZFkuoLxLLZF7r+jSMz50DQHByiWg0MLBZPbA0lFUU 4PVz0bkOoWut4C+lM8Mr9QpXcPJ8BfzNDJOXLc33B5Ctc= Received: from localhost.localdomain (unknown []) by gzsmtp5 (Coremail) with SMTP id QCkvCgDnD3ymt2pqpKo1EA--.54817S2; Thu, 30 Jul 2026 10:32:06 +0800 (CST) Message-ID: <6A6AB796.1040906@126.com> Date: Thu, 30 Jul 2026 10:31:50 +0800 From: Hongling Zeng User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 To: Mukesh Savaliya , Hongling Zeng , alexandre.belloni@bootlin.com, Frank.Li@nxp.com, amergnat@baylibre.com, tze.yee.ng@altera.com, adrian.ho.yin.ng@altera.com CC: linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] i3c: fix potential NULL dereference in send_ccc_cmd_locked References: <20260728063045.73473-1-zenghongling@kylinos.cn> <5ac5f386-1b95-4b30-a7e2-c246c9bfad68@oss.qualcomm.com> In-Reply-To: <5ac5f386-1b95-4b30-a7e2-c246c9bfad68@oss.qualcomm.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-CM-TRANSID:QCkvCgDnD3ymt2pqpKo1EA--.54817S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7AFyrtFyfGr48ArWxJF4kXrb_yoW8WrWfp3 y8Ca10k348tFW8GF42qa13ZayYqwnIq3yrKF43X3ya9FWjyF1ktF1UWw1FvasrXFn5ArWY qryYqa1UuFZ0v37anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07j8J5rUUUUU= X-CM-SenderInfo: x2kr0wpolqwiqxrzqiyswou0bp/xtbBrwdMHWpqt6fzLwAA31 在 2026年07月28日 18:27, Mukesh Savaliya 写道: > > > On 7/28/2026 12:00 PM, Hongling Zeng wrote: >> The retry loop added in commit 02cc832191dd ("i3c: master: Validate GET >> CCC payload length and retry Direct GET once") resets payload >> actual_len >> before each attempt. However, cmd->dests is only validated for DIRECT >> CCC commands (I3C_CCC_DIRECT bit set). For broadcast commands, dests >> can be NULL while ndests > 0, causing a NULL pointer dereference at >> cmd->dests[i].payload.actual_len. >> >> Fix by restricting the actual_len reset to DIRECT commands. >> >> Fixes: 02cc832191dd ("i3c: master: Validate GET CCC payload length >> and retry Direct GET once") >> Signed-off-by: Hongling Zeng >> --- >> drivers/i3c/master.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c >> index fd3e79d10c84..21212c34c31e 100644 >> --- a/drivers/i3c/master.c >> +++ b/drivers/i3c/master.c >> @@ -1051,7 +1051,7 @@ static int >> i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, >> for (attempt = 0; attempt < max_attempts; attempt++) { >> unsigned int i; >> - if (cmd->rnw) >> + if (cmd->rnw && (cmd->id & I3C_CCC_DIRECT)) > > Please review this recent fix @ > https://lore.kernel.org/all/amJau9LgehYLnR20@lizhi-Precision-Tower-5810/ > | |Thanks, Adrian's fix makes more sense by validating the input at the entry point rather than fixing only the retry loop use site.| | >> for (i = 0; i < cmd->ndests; i++) >> cmd->dests[i].payload.actual_len = 0;