Re: [PATCH v5 08/17] i3c: renesas: Fix out-of-bounds access for newdevs mask

[Frank Li]

On Mon, Jul 13, 2026 at 04:05:36PM +0300, Claudiu Beznea wrote:
> From: Claudiu Beznea <claudiu.beznea.uj@xxxxxxxxxxxxxx>
>
> When software initiates DAA (Dynamic Address Assignment), the controller
> reports the result via the NRSPQP (Normal Response Queue Port Register).
> The data length field of the response descriptor, which is accessible
> through the NRSPQP register, indicates the number of devices remaining
> after DAA. Consequently, when the bus is empty, this field contains the
> maximum number of devices supported by the controller (8 for the Renesas
> I3C controller).
>
> Adjust the condition that computes the newly discovered devices bitmask
> to prevent an out-of-bounds when the I3C bus is empty.
>
> Fixes: e7218986319b ("i3c: renesas: Add suspend/resume support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@xxxxxxxxxxxxxx>
> ---

Reviewed-by: Frank Li <Frank.Li@xxxxxxx>

>
> Changes in v5:
> - none; this patch is new
>
>  drivers/i3c/master/renesas-i3c.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/i3c/master/renesas-i3c.c b/drivers/i3c/master/renesas-i3c.c
> index b9784d238f61..c459e40fd5ff 100644
> --- a/drivers/i3c/master/renesas-i3c.c
> +++ b/drivers/i3c/master/renesas-i3c.c
> @@ -703,7 +703,11 @@ static int renesas_i3c_daa(struct i3c_master_controller *m)
>
>  	renesas_i3c_wait_xfer(i3c, xfer);
>
> -	newdevs = GENMASK(i3c->maxdevs - cmd->rx_count - 1, 0);
> +	if (cmd->rx_count >= i3c->maxdevs)
> +		newdevs = 0;
> +	else
> +		newdevs = GENMASK(i3c->maxdevs - cmd->rx_count - 1, 0);
> +
>  	newdevs &= ~olddevs;
>
>  	for (pos = 0; pos < i3c->maxdevs; pos++) {
> --
> 2.43.0
>