Re: [PATCH v4 1/2] cxl/cdat: Fix uninitialized stack use in bandwidth gathering

[Jonathan Cameron <jic23@kernel.org>]

On Mon, 31 Aug 2026 09:01:33 -0700
Dave Jiang <dave.jiang@intel.com> wrote:

> On 8/31/26 2:22 AM, Guixin Liu wrote:
> > cxl_endpoint_gather_bandwidth() and cxl_switch_gather_bandwidth() declare
> > access_coordinate arrays on the stack and rely on their helpers to fill
> > them. The helpers assign only the bandwidth members, and the combine step
> > assigns even those only when both inputs are non-zero. The latency members
> > are summed from stack residue on every call, and the bandwidth members
> > keep that residue into the region access coordinate sysfs attributes when
> > the endpoint CDAT reports no bandwidth.
> > 
> > Zero initialize the arrays. Zero is the value this code already uses for
> > "not reported", so an unset member now reads back as unknown rather than as
> > a plausible number.
> > 
> > Found by code inspection. Tested on a QEMU CXL topology with two endpoints
> > sharing a switch upstream link and HMAT generic-port coordinates for the
> > host bridge, which the calculation requires to run at all: with temporary
> > printk at the combine sites, the unpatched kernel summed 0xfefefefe, the
> > CONFIG_INIT_STACK_ALL_PATTERN stack filler, into the latency members, while
> > the patched kernel reports the CDAT latency values there.
> > 
> > Fixes: a5ab0de0ebaa ("cxl: Calculate region bandwidth of targets with shared upstream link")
> > Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
> > Reviewed-by: Richard Cheng <icheng@nvidia.com>  
> 
> Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>