starred/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-04-06 06:11:08 +00:00
Code Issues 380 Packages Projects Releases Wiki Activity

hw/i3c/dw-i3c: Fix uninitialized data use in short transfer

Browse Source 
Coverity reports that dw_i3c_short_transfer() may pass an
uninitialized buffer to dw_i3c_send().

The immediate cause is the use of `data[len] += arg.byte0`, which
reads from an uninitialized element of the buffer. Replace this with
a simple assignment.

Additionally, avoid calling dw_i3c_send() when the constructed payload
length is zero. In that case the transfer has no data phase, so the
controller can transition to the idle state directly.

This resolves the Coverity UNINIT warning and clarifies the handling
of zero-length short transfers.

Resolves: Coverity CID 1645555
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260311021319.1053774-1-jamin_lin@aspeedtech.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
This commit is contained in:
Jamin Lin
2026-03-11 02:13:20 +00:00
committed by Philippe Mathieu-Daudé
parent 34aad58901
commit 56bd07a859
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
hw/i3c/dw-i3c.c
View File

@@ -1213,7 +1213,7 @@ static void dw_i3c_short_transfer(DWI3C *s, DWI3CTransferCmd cmd,
* ignored.
*/
if (cmd.dbp) {
data[len] += arg.byte0;
data[len] = arg.byte0;
len++;
}
}
@@ -1228,10 +1228,16 @@ static void dw_i3c_short_transfer(DWI3C *s, DWI3CTransferCmd cmd,
len++;
}
if (dw_i3c_send(s, data, len, &bytes_sent, is_i2c)) {
err = DW_I3C_RESP_QUEUE_ERR_I2C_NACK;
if (len > 0) {
if (dw_i3c_send(s, data, len, &bytes_sent, is_i2c)) {
err = DW_I3C_RESP_QUEUE_ERR_I2C_NACK;
} else {
/* Only go to an idle state on a successful transfer. */
ARRAY_FIELD_DP32(s->regs, PRESENT_STATE, CM_TFR_ST_STATUS,
DW_I3C_TRANSFER_STATE_IDLE);
}
} else {
/* Only go to an idle state on a successful transfer. */
/* No payload bytes for this short transfer. */
ARRAY_FIELD_DP32(s->regs, PRESENT_STATE, CM_TFR_ST_STATUS,
DW_I3C_TRANSFER_STATE_IDLE);
}