[linux-next:master 6910/8209] drivers/i3c/master.c:1047 i3c_master_send_ccc_cmd_locked() error: we previously assumed 'cmd->dests' could be null (see line 1033)

BCC: [email protected]
CC: [email protected]
TO: Adrian Ng Ho Yin <[email protected]>
CC: Alexandre Belloni <[email protected]>
CC: Tze Yee Ng <[email protected]>
CC: Alexandre Mergnat <[email protected]>
CC: Frank Li <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head:   290aaf24a551d5a0dce037e3fab30820f9113a10
commit: 02cc832191dd891f7e44003a775eb5d5a4fabb40 [6910/8209] i3c: master: Validate GET CCC payload length and retry Direct GET once
:::::: branch date: 23 hours ago
:::::: commit date: 2 days ago
config: x86_64-randconfig-161-20260722 (https://download.01.org/0day-ci/archive/20260722/[email protected]/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
drivers/i3c/master.c:1047 i3c_master_send_ccc_cmd_locked() error: we previously assumed 'cmd->dests' could be null (see line 1033)

vim +1047 drivers/i3c/master.c

02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1008  
ef8b5229348f07 Jorge Marques    2026-03-23  1009  /**
ef8b5229348f07 Jorge Marques    2026-03-23  1010   * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes)
ef8b5229348f07 Jorge Marques    2026-03-23  1011   * @master: master used to send frames on the bus
ef8b5229348f07 Jorge Marques    2026-03-23  1012   * @cmd: command to send
ef8b5229348f07 Jorge Marques    2026-03-23  1013   *
ef8b5229348f07 Jorge Marques    2026-03-23  1014   * Return: 0 in case of success, or a negative error code otherwise.
ef8b5229348f07 Jorge Marques    2026-03-23  1015   *         I3C Mx error codes are stored in cmd->err.
ef8b5229348f07 Jorge Marques    2026-03-23  1016   */
3a379bbcea0af6 Boris Brezillon  2017-07-19  1017  static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
3a379bbcea0af6 Boris Brezillon  2017-07-19  1018  					  struct i3c_ccc_cmd *cmd)
3a379bbcea0af6 Boris Brezillon  2017-07-19  1019  {
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1020  	unsigned int attempt, max_attempts;
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1021  	int ret;
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1022  
3a379bbcea0af6 Boris Brezillon  2017-07-19  1023  	if (!cmd || !master)
3a379bbcea0af6 Boris Brezillon  2017-07-19  1024  		return -EINVAL;
3a379bbcea0af6 Boris Brezillon  2017-07-19  1025  
3a379bbcea0af6 Boris Brezillon  2017-07-19  1026  	if (WARN_ON(master->init_done &&
3a379bbcea0af6 Boris Brezillon  2017-07-19  1027  		    !rwsem_is_locked(&master->bus.lock)))
3a379bbcea0af6 Boris Brezillon  2017-07-19  1028  		return -EINVAL;
3a379bbcea0af6 Boris Brezillon  2017-07-19  1029  
3a379bbcea0af6 Boris Brezillon  2017-07-19  1030  	if (!master->ops->send_ccc_cmd)
d10a4c323883c4 Wolfram Sang     2025-06-28  1031  		return -EOPNOTSUPP;
3a379bbcea0af6 Boris Brezillon  2017-07-19  1032  
3a379bbcea0af6 Boris Brezillon  2017-07-19 @1033  	if ((cmd->id & I3C_CCC_DIRECT) && (!cmd->dests || !cmd->ndests))
3a379bbcea0af6 Boris Brezillon  2017-07-19  1034  		return -EINVAL;
3a379bbcea0af6 Boris Brezillon  2017-07-19  1035  
3a379bbcea0af6 Boris Brezillon  2017-07-19  1036  	if (master->ops->supports_ccc_cmd &&
3a379bbcea0af6 Boris Brezillon  2017-07-19  1037  	    !master->ops->supports_ccc_cmd(master, cmd))
d10a4c323883c4 Wolfram Sang     2025-06-28  1038  		return -EOPNOTSUPP;
3a379bbcea0af6 Boris Brezillon  2017-07-19  1039  
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1040  	max_attempts = cmd->retries + 1;
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1041  	ret = -EIO;
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1042  	for (attempt = 0; attempt < max_attempts; attempt++) {
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1043  		unsigned int i;
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1044  
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1045  		if (cmd->rnw)
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1046  			for (i = 0; i < cmd->ndests; i++)
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08 @1047  				cmd->dests[i].payload.actual_len = 0;
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1048  
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1049  		cmd->err = I3C_ERROR_UNKNOWN;
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1050  		ret = master->ops->send_ccc_cmd(master, cmd);
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1051  		if (!ret && cmd->err == I3C_ERROR_UNKNOWN)
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1052  			break;
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1053  	}
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1054  
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1055  	if (!ret)
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1056  		ret = i3c_ccc_validate_payload_len(cmd);
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1057  
02cc832191dd89 Adrian Ng Ho Yin 2026-07-08  1058  	return ret;
3a379bbcea0af6 Boris Brezillon  2017-07-19  1059  }
3a379bbcea0af6 Boris Brezillon  2017-07-19  1060  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki