Received-SPF: pass (google.com: domain of linux-kernel+bounces-22847-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: Frank Li <Frank.Li@nxp.com>
To: frank.li@nxp.com
Cc: alexandre.belloni@bootlin.com,
	conor.culhane@silvaco.com,
	imx@lists.linux.dev,
	joe@perches.com,
	linux-i3c@lists.infradead.org,
	linux-kernel@vger.kernel.org,
	miquel.raynal@bootlin.com,
	zbigniew.lukwinski@linux.intel.com
Subject: [PATCH 1/1] i3c: master: svc: return error when read length bigger than 255
Date: Wed, 10 Jan 2024 17:25:03 -0500
Message-Id: <20240110222503.2381599-1-Frank.Li@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?q0YfMT+/HuVeEzoDerJANV8D1xL8nTxX8ioZs/AHnHftOWQ2XdQFVLozqEBF?=
 =?us-ascii?Q?rEk7M7rHBIzLnALg/kaWR4AnycTLdf3+20DI152+HOy9xis9di8PHUGrYN7r?=
 =?us-ascii?Q?5UPLigQbuGgmltYkoj9NvQpaRukF0+9MyeidoUTNOEpPBhYSlWXn0a3gmjH3?=
 =?us-ascii?Q?xezGLnYWLGH5vYdQlJ5egsLUHcohPyRtUJxUxx0G/UNqJsIXGWxBuH44/c+b?=
 =?us-ascii?Q?fk2kdkZlyrJEZAIVk1SHsPORXm35logPEspG7AeKG/m+T6LA0OJg/8AqDdGw?=
 =?us-ascii?Q?AX76OTiKaW3Kwvc5ZVYA7g3UWm0AyqqS5G+OeOD1NhUzoGZFGq1Bytkj1khn?=
 =?us-ascii?Q?F61nZ19KvffmnBngzr00LgsalVB63KP8M/S3uQAX91ku4v0xzI75TF11wCtS?=
 =?us-ascii?Q?aoCdIjJfFP72LsA2miXL7GfvbVjwzBS54vveWCuKMUQyeXqU8FySASrzLkoj?=
 =?us-ascii?Q?QFs7B/5i0mOq2/L8RVcMzfRJpz+8o51OQvzK2BOdRmoU/iU7c50xRAjPAwPd?=
 =?us-ascii?Q?HfvVDUNhYKsq1PFh84hMNDzf/2js784rNCL3vuIUUDDJWz+MY2TC4d620ARb?=
 =?us-ascii?Q?pd+zvDcQ+vtG5xMTvkn2UFUPSSp2IGg0ZTLwEIDpHzapbnS+xa8on9/VI7s1?=
 =?us-ascii?Q?xYen3brHlaPIR/oc+1P962/DzXDVo0P2vmr48kaOj8xr1FYZE+4/XRKXjzr3?=
 =?us-ascii?Q?sQguc1Xg2dMxHFY3fkADV1L2oA86cUuQjCdSiC2GljF4G1U3QCBCOG7vG7gL?=
 =?us-ascii?Q?eBClP7d4906zYwrlEkPR6NUdeNfklvVq4DRiewvqaSXcYkgwsoeydappbbDg?=
 =?us-ascii?Q?1NvmGdxGumi5dHktL8/l6LzZaYcYlJMDT/DkjzqvV4zMBMLQq/+LZJf3ZtKM?=
 =?us-ascii?Q?37pV2ED0paWSGjT0iWJL9zstuCUrKymyPAIL8AMBJevH+rWyIyaYHR7xA4RO?=
 =?us-ascii?Q?ENDmfRnhSu9w51OYYVf1DHCFP/04uMurDC8YhvcT6b1DR3/EhQjayQnxGfvb?=
 =?us-ascii?Q?qmioE3+AQOfQybohGkM3RHCfFHgAQiijxynTEwASSdMVMSfZkGx7jYpiiDZT?=
 =?us-ascii?Q?mXmCXz5F+StCOSsCvtGydhcK3rkgHWMyhc0CyJefov37vwBKoNwdFYp7eBDz?=
 =?us-ascii?Q?OBvG2QcVIWpC0bQDXjGd+F7yZ7Dt0p8lEulaJ8w+31JNeZk/ecq5VNjqCfJM?=
 =?us-ascii?Q?MdTJSAlYm9apr5wxzZofCK4dBnpwV7olQgm9GBrmVXF9CwmZ2ZaGAXR0NpVv?=
 =?us-ascii?Q?yjfMDnSYbzAUhK7ZKfGShpgmpWD7x1O1jB80Z17lOIamkREADXAhnTCOJctY?=
 =?us-ascii?Q?ErpuUAY6daxFe8UBC0NZ6ldsZPi20/GohWQwQJADlH4xu3X2EsyfTVTklxlf?=
 =?us-ascii?Q?m8bOtO3JNngrnFgKwjx8tvtc6Lpw94RNziRz6dQnh4LLdocHLO9TP8wQXyxB?=
 =?us-ascii?Q?zXK9c/t9KSaxO9wYr0J70ENrc+LWmq5Ft/vv4WdnhFSnf0FHlVKPjroIgme2?=
 =?us-ascii?Q?pYDLSmxiMAEGxCLJxoUVPDM+db8LG4cBQPKZHgFon8beqAUqh61I6XZG/xVf?=
 =?us-ascii?Q?2Yrz2IcH0a4wQ2Zc768Ywe5AMe9cAo8+HGW9RNCK?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 150f2404-1b34-4e12-7d8f-08dc122b0e04
X-MS-Exchange-CrossTenant-AuthSource: AS8PR04MB7511.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Jan 2024 22:25:31.1228
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: h9rZSlp+FUXh3Wl7ps0Ps2gi+6PoFs2SQWlRgCd05mCcLz1DE0/W2XIT1L7IjEkSq1QqK2yRUud7hZ6dxvUitQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DUZPR04MB10014

RDTERM in MCTRL is 8 bits. Add a length check to prevent silent data errors
when the read length exceeds 255 bytes during each i3c_priv_xfer operation.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
 drivers/i3c/master/svc-i3c-master.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index bd10bb698da0f..181b56953fb28 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -1375,6 +1375,11 @@ static int svc_i3c_master_priv_xfers(struct i3c_dev_desc *dev,
 		cmd->len = xfers[i].len;
 		cmd->actual_len = xfers[i].rnw ? xfers[i].len : 0;
 		cmd->continued = (i + 1) < nxfers;
+
+		if (cmd->rnw && cmd->len > 255) {
+			dev_err(master->dev, "only support read less than 255 each xfer\n");
+			return -EINVAL;
+		}
 	}
 
 	mutex_lock(&master->lock);
-- 
2.34.1