[PATCH V2 05/17] i3c: master: Remove stale GETSTATUS length check

[Adrian Hunter]

On 17/09/2026 22:26, sashiko-bot at kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] i3c: GETSTATUS silent success on 0-byte read with amd-i3c-master
> --
> 
> commit f719c6d08e31060f2440ad1b34f948657af68459
> Author: Adrian Hunter <adrian.hunter at intel.com>
> 
>     i3c: master: Remove stale GETSTATUS length check
> 
> This commit removes an explicit length check in i3c_master_getstatus_locked(),
> relying instead on the generic CCC response length validation.
> 
>> diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
>> index 425b98e6efaaa..c50887b0b37d0 100644
>> --- a/drivers/i3c/master.c
>> +++ b/drivers/i3c/master.c
>> @@ -1777,11 +1777,6 @@ static int i3c_master_getstatus_locked(struct i3c_master_controller *master,
>>  	if (ret)
>>  		goto out;
>>  
>> -	if (dest.payload.len != sizeof(*getstatus)) {
>> -		ret = -EIO;
>> -		goto out;
>> -	}
>> -
>>  	if (status)
>>  		*status = be16_to_cpu(getstatus->status);
> 
> [Severity: Medium]
> Does removing this explicit length check introduce a silent failure on systems
> using the amd-i3c-master controller?
> 
> When an I3C device terminates a GETSTATUS read with 0 bytes on the
> amd-i3c-master controller, the driver incorrectly mutates payload.len to 0
> instead of setting actual_len.

FWIW, already fixed:

	https://lore.kernel.org/all/20260908111207.3274407-1-shubhamsanjay.patil@amd.com/

> 
> The generic validation in i3c_ccc_validate_payload_len() explicitly skips
> validation if !p->len, incorrectly returning success. Before this patch, the
> explicit length check here safely caught the driver's mutated 0-length and
> correctly returned -EIO.
> 
> Without this check, the function silently succeeds and reads the zeroed
> getstatus->status structure. Can this lead to incorrect behavior on these
> systems?
>