Re: [PATCH 01/17] i3c: master: Fix out-of-bounds read in DMA bounce buffer setup

[Frank Li]

On Mon, Sep 14, 2026 at 02:29:47PM +0300, Adrian Hunter wrote:
> When a bounce buffer is required for DMA_TO_DEVICE transfers,
> i3c_master_dma_map_single() rounds the DMA mapping length up to a
> cache-line boundary:
>
> 	map_len = ALIGN(len, cache_line_size());
>
> It then allocates the bounce buffer with:
>
> 	kmemdup(buf, map_len, GFP_KERNEL);
>
> kmemdup() copies the full allocation size, causing it to read map_len
> bytes from buf even though only len bytes are valid.  This results in an
> out-of-bounds read of up to cache_line_size() - 1 bytes past the end of
> the caller's buffer.
>
> Fix the issue by allocating the bounce buffer with kzalloc() and copying
> only len bytes from the original buffer.  The remaining bytes up to
> map_len stay zero-filled, avoiding both the out-of-bounds read and
> exposure of unrelated memory contents to the DMA engine.
>
> Fixes: f8d9e56aeb87 ("i3c: master: Add helpers for DMA mapping and bounce buffer handling")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Adrian Hunter <adrian.hunter@xxxxxxxxx>
> ---

Reviewed-by: Frank Li <Frank.Li@xxxxxxx>

>  drivers/i3c/master.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
> index afcd7a21a3e6..f9a6c8560fab 100644
> --- a/drivers/i3c/master.c
> +++ b/drivers/i3c/master.c
> @@ -2216,12 +2216,11 @@ struct i3c_dma *i3c_master_dma_map_single(struct device *dev, void *buf,
>
>  	if (force_bounce) {
>  		dma_xfer->map_len = ALIGN(len, cache_line_size());
> -		if (dir == DMA_FROM_DEVICE)
> -			bounce = kzalloc(dma_xfer->map_len, GFP_KERNEL);
> -		else
> -			bounce = kmemdup(buf, dma_xfer->map_len, GFP_KERNEL);
> +		bounce = kzalloc(dma_xfer->map_len, GFP_KERNEL);
>  		if (!bounce)
>  			return NULL;
> +		if (dir != DMA_FROM_DEVICE)
> +			memcpy(bounce, buf, len);
>  		dma_buf = bounce;
>  	}
>
> --
> 2.53.0
>