All of lore.kernel.org
 help / color / mirror / Atom feed
From: Guixin Liu <kanie@linux.alibaba.com>
To: Davidlohr Bueso <dave@stgolabs.net>,
	Jonathan Cameron <jic23@kernel.org>,
	Dave Jiang <dave.jiang@intel.com>,
	Alison Schofield <alison.schofield@intel.com>,
	Vishal Verma <vishal.l.verma@intel.com>,
	Dan Williams <djbw@kernel.org>, Ira Weiny <iweiny@kernel.org>,
	Li Ming <ming.li@zohomail.com>, Robert Richter <rrichter@amd.com>
Cc: linux-cxl@vger.kernel.org, xlpang@linux.alibaba.com,
	oliver.yang@linux.alibaba.com
Subject: [PATCH 4/8] cxl/pci: Fix NULL pointer dereference in reset detection
Date: Tue, 11 Aug 2026 19:36:04 +0800	[thread overview]
Message-ID: <20260811113608.2815625-5-kanie@linux.alibaba.com> (raw)
In-Reply-To: <20260811113608.2815625-1-kanie@linux.alibaba.com>

__cxl_endpoint_decoder_reset_detected() reads the HDM decoder control
register without checking that the endpoint has any:

	cxlhdm = dev_get_drvdata(&port->dev);
	hdm = cxlhdm->regs.hdm_decoder;
	ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(cxld->id));

For a device that has no component registers and describes its HDM ranges
through the CXL DVSEC range registers instead, devm_cxl_setup_hdm() returns
early with cxlhdm->regs.hdm_decoder left NULL and the decoder count taken
from the DVSEC ranges. Those emulated decoders are published with
CXL_DECODER_F_ENABLE set by cxl_setup_hdm_decoder_from_dvsec(), so
cxl_reset_done() walking the endpoint's decoders after an FLR or SBR
reaches the readl() with a NULL base and oopses.

Bail out when there are no HDM decoder registers, mirroring the existing
!hdm test in should_emulate_decoders(). Without those registers there is no
Committed bit to sample, so report "no reset detected" rather than
dereferencing NULL.

Fixes: 934edcd436dc ("cxl: Add post-reset warning if reset results in loss of previously committed HDM decoders")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
 drivers/cxl/core/pci.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index e4338fd7e01b..2515ef4282f2 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -684,6 +684,14 @@ static int __cxl_endpoint_decoder_reset_detected(struct device *dev, void *data)
 
 	cxlhdm = dev_get_drvdata(&port->dev);
 	hdm = cxlhdm->regs.hdm_decoder;
+
+	/*
+	 * Devices that describe their HDM ranges with the DVSEC range
+	 * registers have no HDM decoder registers to consult.
+	 */
+	if (!hdm)
+		return 0;
+
 	ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(cxld->id));
 
 	return !FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMITTED, ctrl);
-- 
2.43.7


  parent reply	other threads:[~2026-08-11 11:36 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-11 11:36 [PATCH 0/8] cxl: Assorted fixes Guixin Liu
2026-08-11 11:36 ` [PATCH 1/8] cxl/features: Validate the fwctl RPC input length Guixin Liu
2026-08-11 11:36 ` [PATCH 2/8] cxl/features: Bound the Get Feature output by the user output buffer Guixin Liu
2026-08-11 11:36 ` [PATCH 3/8] cxl/core: Fix dport use-after-free via the einj_inject debugfs file Guixin Liu
2026-08-11 16:03   ` Li Ming
2026-08-12  1:58     ` Guixin Liu
2026-08-11 11:36 ` Guixin Liu [this message]
2026-08-11 11:36 ` [PATCH 5/8] cxl/hdm: Fix out of bounds read of the decoder target list Guixin Liu
2026-08-11 11:36 ` [PATCH 6/8] cxl/cdat: Fix uninitialized stack use in endpoint bandwidth gathering Guixin Liu
2026-08-11 11:36 ` [PATCH 7/8] cxl/mce: Validate the memdev and endpoint before use Guixin Liu
2026-08-11 11:36 ` [PATCH 8/8] cxl/region: Unregister the pmem region bridge on setup failure Guixin Liu
2026-08-11 19:57 ` [PATCH 0/8] cxl: Assorted fixes Alison Schofield
2026-08-12  2:10   ` Guixin Liu
2026-08-12  6:29     ` Richard Cheng
2026-08-12  6:37       ` Guixin Liu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260811113608.2815625-5-kanie@linux.alibaba.com \
    --to=kanie@linux.alibaba.com \
    --cc=alison.schofield@intel.com \
    --cc=dave.jiang@intel.com \
    --cc=dave@stgolabs.net \
    --cc=djbw@kernel.org \
    --cc=iweiny@kernel.org \
    --cc=jic23@kernel.org \
    --cc=linux-cxl@vger.kernel.org \
    --cc=ming.li@zohomail.com \
    --cc=oliver.yang@linux.alibaba.com \
    --cc=rrichter@amd.com \
    --cc=vishal.l.verma@intel.com \
    --cc=xlpang@linux.alibaba.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.