Error while loading dw-i3c-master: UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:885:12

[Louis Sautier]

On 12/8/25 21:58, Alexandre Belloni wrote:
> Hello Louis,
>
> On 02/12/2025 21:17:31+0100, Louis Sautier wrote:
>> Hello,
>>
>> I'm running into a bug when loading the dw-i3c-master module on kernel 6.18
>> on one specific server. I suspect it has to do with the large number of
>> CPUs on the machine (768 threads, from 2 AMD EPYC 9965 processors) but I am
>> not sure.
>>
>> The system is on Ubuntu 25.10 and a 6.18 kernel with https://gist.githubusercontent.com/sbraz/a6f37fafbcf9354bbe4eace9e9eb48cb/raw/115da594dc9d7ea99b06754847571e6fd76d9da5/config
>> (basically Ubuntu's).
> Just to be sure, does this also happen with v6.17?
>
> The only change is the shutdown handling so I would guess yes.
>
Hello,

It does happen with 6.17. I initially discovered this while running 
Ubuntu 25.10's stock kernel (6.17.0).

 > What is the behavior when you build the dw-i3c-master as a static 
driver? I'll try CONFIG_DW_I3C_MASTER=y and report back.

Someone also suggested (they didn't reply to the list though) that I add 
a printk to see what the value of maxdevs is. I'll provide the log as 
soon as I have rebuilt with:

--- linux-6.18.orig/drivers/i3c/master/dw-i3c-master.c	2025-11-30 22:42:10.000000000 +0000
+++ linux-6.18/drivers/i3c/master/dw-i3c-master.c	2025-12-08 18:17:33.151567225 +0000
@@ -1588,6 +1588,7 @@
  	ret = readl(master->regs + DEVICE_ADDR_TABLE_POINTER);
  	master->datstartaddr = ret;
  	master->maxdevs = ret >> 16;
+	printk("maxdevs: %d\n",  master->maxdevs);
  	master->free_pos = GENMASK(master->maxdevs - 1, 0);
  
  	master->quirks = (unsigned long)device_get_match_data(&pdev->dev);