Re: [PATCH v3] cxl/region: Unregister the pmem region when the bridge is unbound

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Race condition leading to NULL pointer dereference in cxl_pmem_region_probe().
--

commit 46b44f91e80687bcb216394e5b204e067ed40c6d
Author: Guixin Liu <kanie@linux.alibaba.com>

cxl/region: Unregister the pmem region when the bridge is unbound

This commit addresses an issue where removing cxl_acpi unbinds the nvdimm
bridge before the regions it serves, leaving an orphan pmem region. It
updates devm_cxl_add_pmem_region() to unregister the cxl_pmem_region
synchronously when the bridge is unbound.

> diff --git a/drivers/cxl/core/region_pmem.c b/drivers/cxl/core/region_pmem.c
> index 23d97e3d78b6a..7ab1373a95e01 100644
> --- a/drivers/cxl/core/region_pmem.c
> +++ b/drivers/cxl/core/region_pmem.c
> @@ -168,12 +168,14 @@ int devm_cxl_add_pmem_region(struct cxl_region *cxlr)
>  		dev_name(dev));
>  
>  	scoped_guard(device, &cxl_nvb->dev) {
> -		if (cxl_nvb->dev.driver)
> +		if (cxl_nvb->dev.driver) {
>  			rc = devm_add_action_or_reset(&cxl_nvb->dev,
>  						      cxlr_pmem_unregister,
>  						      cxlr_pmem);
> -		else
> +		} else {
>  			rc = -ENXIO;
> +			cxlr_pmem_unregister(cxlr_pmem);

[Severity: High]
This isn't a bug introduced by this patch, but this patch extends the
usage of cxlr_pmem_unregister() in the synchronous error path, keeping a
vulnerability active.

Can a race condition lead to a NULL pointer dereference in
cxl_pmem_region_probe()?

If the cxl_pmem driver is loaded (e.g., via modprobe) concurrently with the
unbinding of the cxl_acpi bridge (or if devm_cxl_add_pmem_region() fails on
the bridge unbound check), cxlr_pmem_unregister() is called on another CPU.

cxlr_pmem_unregister() sets the pointer to NULL without holding the region
device's lock:

drivers/cxl/core/region_pmem.c:cxlr_pmem_unregister() {
    ...
    cxlr_pmem->cxlr = NULL;
    device_unregister(&cxlr_pmem->dev);
    ...
}

Simultaneously, the driver core calls cxl_pmem_region_probe() which holds the
device lock, but reads the concurrently nullified pointer and dereferences it:

drivers/cxl/pmem.c:cxl_pmem_region_probe() {
    ...
    struct cxl_region *cxlr = cxlr_pmem->cxlr;
    struct cxl_nvdimm_bridge *cxl_nvb = cxlr->cxl_nvb;
    ...
}

Does this code open a race window against the probe function, resulting
in a crash?

> +		}
>  	}
>  
>  	if (rc)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831061120.200790-1-kanie@linux.alibaba.com?part=1