Re: [PATCH v6 6/9] cxl/pci: Track memdevs affected by CXL reset

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Inactive CXL memdevs are skipped during lock acquisition, allowing concurrent driver binding and hardware access during PCI reset.
--

commit 89d0ec881cc974737d27ee49108cc6db271b06d5
Author: Srirangan Madhavan <smadhavan@nvidia.com>

cxl/pci: Track memdevs affected by CXL reset

This commit adds context tracking for memdevs affected by a CXL reset. It
collects memdevs associated with the target and sibling PCI functions,
identifies which ones are active, and provides helpers to lock them before
the reset proceeds.

> diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
> index 1dd880f5a333f..c755c18c8d84a 100644
> --- a/drivers/cxl/core/pci.c
> +++ b/drivers/cxl/core/pci.c

[ ... ]

> +static int __maybe_unused cxl_reset_lock_memdevs(struct cxl_reset_context *ctx)
> +{
> +	int i;
> +
> +	lockdep_assert_held_write(&cxl_rwsem.region);
> +
> +	for (i = 0; i < ctx->nr_memdevs; i++) {
> +		struct cxl_reset_memdev *rmd = &ctx->memdevs[i];
> +		struct cxl_memdev *cxlmd = rmd->cxlmd;
> +
> +		if (!rmd->active)
> +			continue;
> +

[Severity: High]
Does skipping the device lock for inactive memdevs allow concurrent driver
binding during the PCI reset?

The device lock on the cxl_memdev is used by the driver core to serialize
binding in device_driver_attach(). If a memdev is inactive, skipping this
lock might allow userspace to trigger a driver bind exactly when the
underlying PCI function is disabled and undergoing a physical reset.

Could the concurrent probe proceed to access CXL MMIO registers while the
device is resetting, potentially resulting in PCIe Completion Timeouts or
Unsupported Requests and triggering an AER panic? Should all associated
memdevs be unconditionally locked to block concurrent probe and remove
operations?

> +		if (!device_trylock(&cxlmd->dev))
> +			goto err;
> +
> +		rmd->locked = true;
> +		if (!cxl_reset_memdev_active(cxlmd)) {
> +			cxl_reset_unlock_memdevs(ctx);
> +			return -ENODEV;
> +		}
> +	}
> +
> +	return 0;
> +
> +err:
> +	cxl_reset_unlock_memdevs(ctx);
> +	return -EAGAIN;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260528083154.137979-1-smadhavan@nvidia.com?part=6