Re: [PATCH v5 3/5] cxl/hdm: Add BI coherency support for endpoint decoders

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds stack read causing information leak when interleave ways > 8
--

commit 9868ecd56176bc1d5132787a81a79aa48ca7bada
Author: Davidlohr Bueso <dave@stgolabs.net>

cxl/hdm: Add BI coherency support for endpoint decoders

This commit caches the HDM decoder's Supported Coherency Models on struct
cxl_hdm. It consults this during region attach and defaults target_type
appropriately for uncommitted endpoint decoders.

> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> index 0c80b76a5f9b4..4a41cde9fdba7 100644
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c
[ ... ]
> @@ -1042,12 +1052,20 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
>  		if (cxled) {
>  			struct cxl_memdev *cxlmd = cxled_to_memdev(cxled);
>  			struct cxl_dev_state *cxlds = cxlmd->cxlds;
> +			struct cxl_hdm *cxlhdm = dev_get_drvdata(&port->dev);
>  
>  			/*
> -			 * Default by devtype until a device arrives that needs
> -			 * more precision.
> +			 * HDMs that advertise support for both coherency
> +			 * modes (CXL_HDM_DECODER_COHERENCY_BOTH) default to
> +			 * host-only here; the region attach path will switch
> +			 * target_type to device-coherent if the region's
> +			 * root decoder has the CFMWS BI bit set. Only HDMs
> +			 * that strictly support device-coherent mode default
> +			 * to HDM-DB.
>  			 */
> -			if (cxlds->type == CXL_DEVTYPE_CLASSMEM)
> +			if (cxlds->type == CXL_DEVTYPE_CLASSMEM &&
> +			    cxlhdm->supported_coherency !=
> +			    CXL_HDM_DECODER_COHERENCY_DEV)
>  				cxld->target_type = CXL_DECODER_HOSTONLYMEM;
>  			else
>  				cxld->target_type = CXL_DECODER_DEVMEM;

[Severity: High]
This is a pre-existing issue, but does the later switch decoder initialization
in init_hdm_decoder() read out-of-bounds stack memory when interleave_ways
is greater than 8?

If a device advertises up to 16-way interleave, the target mapping loop
reads past the 8-byte target_list union:

drivers/cxl/core/hdm.c:init_hdm_decoder() {
	union {
		u64 value;
		unsigned char target_id[8];
	} target_list;
	...

	if (!cxled) {
		lo = readl(hdm + CXL_HDM_DECODER0_TL_LOW(which));
		hi = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(which));
		target_list.value = (hi << 32) + lo;
		for (i = 0; i < cxld->interleave_ways; i++)
			cxld->target_map[i] = target_list.target_id[i];

		return 0;
	}
}

Can this loop copy up to 8 bytes of uninitialized stack memory into
cxld->target_map, which might then be exposed to unprivileged userspace
via the world-readable target_list sysfs attribute?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260615145529.13848-1-dave@stgolabs.net?part=3