Re: [PATCH 1/2] cxl/mbox: clamp the event record count to the received payload

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but EDAC memory repair state storage is improperly gated behind a tracepoint condition, breaking memory repair when tracing is disabled.
--

commit 4e03b22d8d72d66a9d7ecd79d1ff3eb2082c4880
Author: Gaobin Huang <huanggaobin23@semi.ac.cn>

cxl/mbox: clamp the event record count to the received payload

This commit derives the event record bound from the mailbox command's
size_out to clamp the record count, preventing out-of-bounds reads when
the device returns a payload smaller than claimed.

> diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
> index 55828a836c01a..a8f51bf0ffc7c 100644
> --- a/drivers/cxl/core/mbox.c
> +++ b/drivers/cxl/core/mbox.c

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing this file I
noticed EDAC memory repair state storage is improperly gated behind a
tracepoint condition in cxl_event_trace_record().

drivers/cxl/core/mbox.c:cxl_event_trace_record() {
    ...
    if (trace_cxl_general_media_enabled() || trace_cxl_dram_enabled()) {
        ...
        if (event_type == CXL_CPER_EVENT_GEN_MEDIA) {
            if (cxl_store_rec_gen_media((struct cxl_memdev *)cxlmd, evt))
    ...
}

Because memory error records are only stored when tracepoints are active,
doesn't this break EDAC memory repair (like PPR or memory sparing) when
tracing is disabled, since the records will be silently dropped and
operations requiring them will abort with -EINVAL?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914125701.1160136-1-huanggaobin23@semi.ac.cn?part=1