Error while loading dw-i3c-master: UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:885:12

[Alexandre Belloni]

On 09/12/2025 12:37:12+0100, Louis Sautier wrote:
> On 12/8/25 21:58, Alexandre Belloni wrote:
> > Hello Louis,
> > 
> > On 02/12/2025 21:17:31+0100, Louis Sautier wrote:
> > > Hello,
> > > 
> > > I'm running into a bug when loading the dw-i3c-master module on kernel 6.18
> > > on one specific server. I suspect it has to do with the large number of
> > > CPUs on the machine (768 threads, from 2 AMD EPYC 9965 processors) but I am
> > > not sure.
> > > 
> > > The system is on Ubuntu 25.10 and a 6.18 kernel with https://gist.githubusercontent.com/sbraz/a6f37fafbcf9354bbe4eace9e9eb48cb/raw/115da594dc9d7ea99b06754847571e6fd76d9da5/config
> > > (basically Ubuntu's).
> > Just to be sure, does this also happen with v6.17?
> > 
> > The only change is the shutdown handling so I would guess yes.
> > 
> Hello,
> 
> It does happen with 6.17. I initially discovered this while running Ubuntu
> 25.10's stock kernel (6.17.0).
> 
> > What is the behavior when you build the dw-i3c-master as a static driver?
> I'll try CONFIG_DW_I3C_MASTER=y and report back.
> 
> Someone also suggested (they didn't reply to the list though) that I add a
> printk to see what the value of maxdevs is. I'll provide the log as soon as
> I have rebuilt with:
> 
> --- linux-6.18.orig/drivers/i3c/master/dw-i3c-master.c	2025-11-30 22:42:10.000000000 +0000
> +++ linux-6.18/drivers/i3c/master/dw-i3c-master.c	2025-12-08 18:17:33.151567225 +0000
> @@ -1588,6 +1588,7 @@
>  	ret = readl(master->regs + DEVICE_ADDR_TABLE_POINTER);
>  	master->datstartaddr = ret;
>  	master->maxdevs = ret >> 16;
> +	printk("maxdevs: %d\n",  master->maxdevs);
>  	master->free_pos = GENMASK(master->maxdevs - 1, 0);
>  	master->quirks = (unsigned long)device_get_match_data(&pdev->dev);
> 

Yes, that was going to be my suggestion.

-- 
Alexandre Belloni, co-owner and COO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com