[PATCH v8 0/4] cxl: Repair poison enumeration regressions

[PATCH v8 0/4] cxl: Repair poison enumeration regressions

[Richard Cheng]

This series repairs four poison enumeration regressions introduced by
commit be5cbd084027 ("cxl: Kill enum cxl_decoder_mode"). It groups the
remaining poison fixes from v7 [1] into a poison repair set.

Patch 1: cxl_get_poison_unmapped() ends the partition walk when it
encounters a fully mapped partition. Continue to the next partition
instead, so unmapped poison in later partitions is still collected.

Patch 2: the unmapped scan tolerates -EFAULT for RAM partitions but
leaves the error in rc. If no later query overwrites rc, enumeration
incorrectly reports failure. Clear rc before continuing past the
tolerated error.

Patch 3: use the ctx->offset handoff from the committed-decoder walk
as the starting point for the unmapped scan. Starting after the highest
DPA allocation leaves ranges allocated to uncommitted decoders
unqueried. Resume at the committed boundary and scan later partitions
from their beginning.

Patch 4: cxl_get_poison_by_memdev() can overwrite an earlier partition
query failure with a later success. Stop on the first error that is
not already tolerated as a RAM -EFAULT, preserving the failure.

In v7 [1] patch 6's review, Jonathan also noted that
cxl_internal_send_cmd() documents -EFAULT as a hardware error.
I will send a separate patch to clarify its mapping from the Invalid
Physical Address device response.

Changes since v7 [1]:
- Retain v7 patches 2–5, renumbered as patches 1–4, and rebase onto
  current cxl/next.
- Drop v7 patches 1 and 7, which have been applied to cxl/next.
- Drop v7 patch 6 because the zero-sized HDM decoder series [2]
  already fixes its negative partition-index access. Specifically,
  commit 00f9ef9ad1ce ("cxl/hdm: Allow zero sized HDM decoders") [3]
  guards the partition lookup while allowing the decoder walk to continue.
- Expand patch 2's commit message to explain how a RAM poison query
  produces -EFAULT and why that response is tolerated.


[1]:
https://lore.kernel.org/linux-cxl/20260902053839.25595-1-icheng@nvidia.com/
[2]:
https://lore.kernel.org/linux-cxl/20260914090858.19181-1-icheng@nvidia.com/
[3]:
https://lore.kernel.org/linux-cxl/20260914090858.19181-3-icheng@nvidia.com/


Richard Cheng (4):
  cxl/region: Scan all partitions for unmapped poison
  cxl/region: Don't leak tolerated RAM -EFAULT from unmapped poison scan
  cxl/region: Start unmapped poison scan at the committed decoder
    boundary
  cxl/memdev: Don't overwrite the error from an earlier partition poison
    query

 drivers/cxl/core/memdev.c |  2 ++
 drivers/cxl/core/region.c | 13 ++++++-------
 2 files changed, 8 insertions(+), 7 deletions(-)


base-commit: f2e9991100c903ec2d8eb62c3a1d6e0b9c67432e
-- 
2.43.0

[PATCH v8 1/4] cxl/region: Scan all partitions for unmapped poison

[Richard Cheng]

cxl_get_poison_unmapped() sweeps the unmapped tail of each partition
from ctx->part onward. A fully-mapped partition has no unmapped tail,
it's a normal per-partition state, but the loop treated it with break,
aborting the whole sweep and silently skipping unmapped poison in all
later partition. Use continue so a fully-mapped partition is skipped and
later partitions are still scanned.

Fixes: be5cbd0840275 ("cxl: Kill enum cxl_decoder_mode")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Tested-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/region.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 5ef0ca0694ff..7c7287315d72 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2952,7 +2952,7 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
 			offset = res->start;
 		length = res->end - offset + 1;
 		if (!length)
-			break;
+			continue;
 		rc = cxl_mem_get_poison(cxlmd, offset, length, NULL);
 		if (poison_efault_forgiven(rc, cxlds->part[i].mode))
 			continue;
-- 
2.43.0

Re: [PATCH v8 1/4] cxl/region: Scan all partitions for unmapped poison

[Davidlohr Bueso]

On Tue, 22 Sep 2026, Richard Cheng wrote:

>cxl_get_poison_unmapped() sweeps the unmapped tail of each partition
>from ctx->part onward. A fully-mapped partition has no unmapped tail,
>it's a normal per-partition state, but the loop treated it with break,
>aborting the whole sweep and silently skipping unmapped poison in all
>later partition. Use continue so a fully-mapped partition is skipped and
>later partitions are still scanned.
>
>Fixes: be5cbd0840275 ("cxl: Kill enum cxl_decoder_mode")
>Reviewed-by: Dave Jiang <dave.jiang@intel.com>
>Reviewed-by: Alison Schofield <alison.schofield@intel.com>
>Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
>Tested-by: Alison Schofield <alison.schofield@intel.com>
>Signed-off-by: Richard Cheng <icheng@nvidia.com>

Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>

>---
> drivers/cxl/core/region.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
>index 5ef0ca0694ff..7c7287315d72 100644
>--- a/drivers/cxl/core/region.c
>+++ b/drivers/cxl/core/region.c
>@@ -2952,7 +2952,7 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
> 			offset = res->start;
> 		length = res->end - offset + 1;
> 		if (!length)
>-			break;
>+			continue;
> 		rc = cxl_mem_get_poison(cxlmd, offset, length, NULL);
> 		if (poison_efault_forgiven(rc, cxlds->part[i].mode))
> 			continue;
>-- 
>2.43.0
>

[PATCH v8 2/4] cxl/region: Don't leak tolerated RAM -EFAULT from unmapped poison scan

[Richard Cheng]

CXL 3.0 section 8.2.9.8.4.1 requires Get Poison List to return Invalid
Physical Address for a volatile range when the device does not support
volatile poison lists.

For example, consider a memdev with a single RAM partition and a
committed decoder covering only part of it:

  RAM partition: [ committed decoder ][ unmapped tail ]

On a device without volatile poison-list support, querying this tail
returns Invalid Physical Address, which cxl_internal_send_cmd() maps
to -EFAULT. The driver tolerates this response for RAM because volatile
poison-list support is optional.

When cxl_get_poison_unmapped() was converted to iterate over partitions,
the RAM-specific error handling became a continue without clearing rc.
If no subsequent query overwrites rc, the function returns the tolerated
-EFAULT and incorrectly reports the enumeration as failed.

Clear rc before continuing, restoring the previous handling of this
expected response for RAM partitions.

Fixes: be5cbd0840275 ("cxl: Kill enum cxl_decoder_mode")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/region.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 7c7287315d72..042356c71ed7 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2954,8 +2954,10 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
 		if (!length)
 			continue;
 		rc = cxl_mem_get_poison(cxlmd, offset, length, NULL);
-		if (poison_efault_forgiven(rc, cxlds->part[i].mode))
+		if (poison_efault_forgiven(rc, cxlds->part[i].mode)) {
+			rc = 0;
 			continue;
+		}
 		if (rc)
 			break;
 	}
-- 
2.43.0

Re: [PATCH v8 2/4] cxl/region: Don't leak tolerated RAM -EFAULT from unmapped poison scan

[Jonathan Cameron]

On Tue, 22 Sep 2026 18:11:27 +0800
Richard Cheng <icheng@nvidia.com> wrote:

> CXL 3.0 section 8.2.9.8.4.1 requires Get Poison List to return Invalid
> Physical Address for a volatile range when the device does not support
> volatile poison lists.
> 
> For example, consider a memdev with a single RAM partition and a
> committed decoder covering only part of it:
> 
>   RAM partition: [ committed decoder ][ unmapped tail ]
> 
> On a device without volatile poison-list support, querying this tail
> returns Invalid Physical Address, which cxl_internal_send_cmd() maps
> to -EFAULT. The driver tolerates this response for RAM because volatile
> poison-list support is optional.
> 
> When cxl_get_poison_unmapped() was converted to iterate over partitions,
> the RAM-specific error handling became a continue without clearing rc.
> If no subsequent query overwrites rc, the function returns the tolerated
> -EFAULT and incorrectly reports the enumeration as failed.
> 
> Clear rc before continuing, restoring the previous handling of this
> expected response for RAM partitions.
> 
> Fixes: be5cbd0840275 ("cxl: Kill enum cxl_decoder_mode")
> Reviewed-by: Dave Jiang <dave.jiang@intel.com>
> Reviewed-by: Alison Schofield <alison.schofield@intel.com>
> Signed-off-by: Richard Cheng <icheng@nvidia.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>

Re: [PATCH v8 2/4] cxl/region: Don't leak tolerated RAM -EFAULT from unmapped poison scan

[Davidlohr Bueso]

On Tue, 22 Sep 2026, Richard Cheng wrote:

>CXL 3.0 section 8.2.9.8.4.1 requires Get Poison List to return Invalid
>Physical Address for a volatile range when the device does not support
>volatile poison lists.
>
>For example, consider a memdev with a single RAM partition and a
>committed decoder covering only part of it:
>
>  RAM partition: [ committed decoder ][ unmapped tail ]
>
>On a device without volatile poison-list support, querying this tail
>returns Invalid Physical Address, which cxl_internal_send_cmd() maps
>to -EFAULT. The driver tolerates this response for RAM because volatile
>poison-list support is optional.
>
>When cxl_get_poison_unmapped() was converted to iterate over partitions,
>the RAM-specific error handling became a continue without clearing rc.
>If no subsequent query overwrites rc, the function returns the tolerated
>-EFAULT and incorrectly reports the enumeration as failed.
>
>Clear rc before continuing, restoring the previous handling of this
>expected response for RAM partitions.
>
>Fixes: be5cbd0840275 ("cxl: Kill enum cxl_decoder_mode")
>Reviewed-by: Dave Jiang <dave.jiang@intel.com>
>Reviewed-by: Alison Schofield <alison.schofield@intel.com>
>Signed-off-by: Richard Cheng <icheng@nvidia.com>

Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>

>---
> drivers/cxl/core/region.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
>diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
>index 7c7287315d72..042356c71ed7 100644
>--- a/drivers/cxl/core/region.c
>+++ b/drivers/cxl/core/region.c
>@@ -2954,8 +2954,10 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
> 		if (!length)
> 			continue;
> 		rc = cxl_mem_get_poison(cxlmd, offset, length, NULL);
>-		if (poison_efault_forgiven(rc, cxlds->part[i].mode))
>+		if (poison_efault_forgiven(rc, cxlds->part[i].mode)) {
>+			rc = 0;
> 			continue;
>+		}
> 		if (rc)
> 			break;
> 	}
>-- 
>2.43.0
>

[PATCH v8 3/4] cxl/region: Start unmapped poison scan at the committed decoder boundary

[Richard Cheng]

poison_by_decoder() stops at the last committed decoder and records the
handoff in ctx->offset, but cxl_get_poison_unmapped() ignores it and
starts after the highest DPA allocation instead. Allocation exist for
uncommitted decoders too, so their DPA is skipped by both phases and
poison there is never reported. Resume the scan at ctx->offset, and scan
later partitions in full, restoring the pre-rewrite behavior.

Fixes: be5cbd084027 ("cxl: Kill enum cxl_decoder_mode")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/region.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 042356c71ed7..4869cdd6a3d4 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2931,7 +2931,6 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
 {
 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
 	const struct resource *res;
-	struct resource *p, *last;
 	u64 offset, length;
 	int rc = 0;
 
@@ -2944,10 +2943,8 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
 	 */
 	for (int i = ctx->part; i < cxlds->nr_partitions; i++) {
 		res = &cxlds->part[i].res;
-		for (p = res->child, last = NULL; p; p = p->sibling)
-			last = p;
-		if (last)
-			offset = last->end + 1;
+		if (i == ctx->part)
+			offset = ctx->offset;
 		else
 			offset = res->start;
 		length = res->end - offset + 1;
-- 
2.43.0

Re: [PATCH v8 3/4] cxl/region: Start unmapped poison scan at the committed decoder boundary

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] cxl: integer underflow in cxl_get_poison_unmapped() from unmapped decoder offset
--

commit 8602a2ffbae3a910b43392bb444acb65b6b365e7
Author: Richard Cheng <icheng@nvidia.com>

cxl/region: Start unmapped poison scan at the committed decoder boundary

poison_by_decoder() stops at the last committed decoder and records the
handoff in ctx->offset, but cxl_get_poison_unmapped() ignores it and
starts after the highest DPA allocation instead. Allocation exist for
uncommitted decoders too, so their DPA is skipped by both phases and
poison there is never reported. Resume the scan at ctx->offset, and scan
later partitions in full, restoring the pre-rewrite behavior.

> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index 042356c71ed79..4869cdd6a3d48 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c

[ ... ]

> @@ -2944,10 +2943,8 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
>  	 */
>  	for (int i = ctx->part; i < cxlds->nr_partitions; i++) {
>  		res = &cxlds->part[i].res;
> -		for (p = res->child, last = NULL; p; p = p->sibling)
> -			last = p;
> -		if (last)
> -			offset = last->end + 1;
> +		if (i == ctx->part)
> +			offset = ctx->offset;
> +		else
> +			offset = res->start;
>  		length = res->end - offset + 1;

[Severity: High]
Does this code risk an integer underflow if offset is greater than res->end?

If poison_by_decoder() encounters a zero-sized commit_end decoder, it can
set ctx->part = -1 and ctx->offset = cxled->dpa_res->end + 1. If that
decoder was configured by firmware with a large skip value, ctx->offset can
be strictly greater than the end of the first partition (part[0].res.end).

Later, cxl_get_poison_by_endpoint() forces ctx.part = 0 before calling
cxl_get_poison_unmapped():

drivers/cxl/core/region.c:cxl_get_poison_by_endpoint() {
    ...
	if (rc == 1) {
		/* ... */
		if (ctx.part < 0)
			ctx.part = 0;
		rc = cxl_get_poison_unmapped(to_cxl_memdev(port->uport_dev),
					     &ctx);
	}
    ...
}

Because ctx.offset is not reset to part[0].res.start, offset is assigned
the out-of-bounds ctx->offset when i == 0. This causes the length
calculation to underflow in unsigned 64-bit arithmetic to an enormous
positive value.

Could this underflow bypass the !length check and result in sending an
invalid mailbox command to the hardware?

A massive out-of-bounds length passed directly to cxl_mem_get_poison() may
cause the CXL device to hang, time out, or process out-of-bounds requests,
leading to system instability.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922101129.52794-1-icheng@nvidia.com?part=3

Re: [PATCH v8 3/4] cxl/region: Start unmapped poison scan at the committed decoder boundary

[Alison Schofield]

On Tue, Sep 22, 2026 at 10:29:59AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] cxl: integer underflow in cxl_get_poison_unmapped() from unmapped decoder offset
> --
> 
> commit 8602a2ffbae3a910b43392bb444acb65b6b365e7
> Author: Richard Cheng <icheng@nvidia.com>
> 
> cxl/region: Start unmapped poison scan at the committed decoder boundary
> 
> poison_by_decoder() stops at the last committed decoder and records the
> handoff in ctx->offset, but cxl_get_poison_unmapped() ignores it and
> starts after the highest DPA allocation instead. Allocation exist for
> uncommitted decoders too, so their DPA is skipped by both phases and
> poison there is never reported. Resume the scan at ctx->offset, and scan
> later partitions in full, restoring the pre-rewrite behavior.
> 
> > diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> > index 042356c71ed79..4869cdd6a3d48 100644
> > --- a/drivers/cxl/core/region.c
> > +++ b/drivers/cxl/core/region.c
> 
> [ ... ]
> 
> > @@ -2944,10 +2943,8 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
> >  	 */
> >  	for (int i = ctx->part; i < cxlds->nr_partitions; i++) {
> >  		res = &cxlds->part[i].res;
> > -		for (p = res->child, last = NULL; p; p = p->sibling)
> > -			last = p;
> > -		if (last)
> > -			offset = last->end + 1;
> > +		if (i == ctx->part)
> > +			offset = ctx->offset;
> > +		else
> > +			offset = res->start;
> >  		length = res->end - offset + 1;
> 
> [Severity: High]
> Does this code risk an integer underflow if offset is greater than res->end?
> 
> If poison_by_decoder() encounters a zero-sized commit_end decoder, it can
> set ctx->part = -1 and ctx->offset = cxled->dpa_res->end + 1. If that
> decoder was configured by firmware with a large skip value, ctx->offset can
> be strictly greater than the end of the first partition (part[0].res.end).
> 
> Later, cxl_get_poison_by_endpoint() forces ctx.part = 0 before calling
> cxl_get_poison_unmapped():
> 
> drivers/cxl/core/region.c:cxl_get_poison_by_endpoint() {
>     ...
> 	if (rc == 1) {
> 		/* ... */
> 		if (ctx.part < 0)
> 			ctx.part = 0;
> 		rc = cxl_get_poison_unmapped(to_cxl_memdev(port->uport_dev),
> 					     &ctx);
> 	}
>     ...
> }
> 
> Because ctx.offset is not reset to part[0].res.start, offset is assigned
> the out-of-bounds ctx->offset when i == 0. This causes the length
> calculation to underflow in unsigned 64-bit arithmetic to an enormous
> positive value.
> 
> Could this underflow bypass the !length check and result in sending an
> invalid mailbox command to the hardware?
> 
> A massive out-of-bounds length passed directly to cxl_mem_get_poison() may
> cause the CXL device to hang, time out, or process out-of-bounds requests,
> leading to system instability.

I (with the help of another non-Sashiko AI) looked into this.
The precondition is not reachable. An empty decoder is assigned the
partition containing its base, request_skip() fails if the skip extends
beyond the partitions, so ctx->offset <= res->end + 1.

I do think this is worth closing down anyway, to avoid revisiting this
again and again and again.

I looked at 2 places to clamp this.

My second choice is in cxl_mem_get_poison() but all of its callers are in
the kernel and have worked out the range from the partition layout.

My first choice is below, right in this patch - 

I wonder if DaveJ will do this upon applying, pretty please :)

 --- a/drivers/cxl/core/region.c
  +++ b/drivers/cxl/core/region.c
  @@ -3032,8 +3032,10 @@ int cxl_get_poison_by_endpoint(struct cxl_port *port)
                   * (every committed decoder is zero-size): scan all
                   * partitions in full.
                   */
  -               if (ctx.part < 0)
  +               if (ctx.part < 0) {
                          ctx.part = 0;
  +                       ctx.offset = 0;
  +               }
                  rc = cxl_get_poison_unmapped(to_cxl_memdev(port->uport_dev),
                                               &ctx);
          }



-- Alison



> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260922101129.52794-1-icheng@nvidia.com?part=3
> 

Re: [PATCH v8 3/4] cxl/region: Start unmapped poison scan at the committed decoder boundary

[Davidlohr Bueso]

On Tue, 22 Sep 2026, Richard Cheng wrote:

>poison_by_decoder() stops at the last committed decoder and records the
>handoff in ctx->offset, but cxl_get_poison_unmapped() ignores it and
>starts after the highest DPA allocation instead. Allocation exist for
>uncommitted decoders too, so their DPA is skipped by both phases and
>poison there is never reported. Resume the scan at ctx->offset, and scan
>later partitions in full, restoring the pre-rewrite behavior.
>
>Fixes: be5cbd084027 ("cxl: Kill enum cxl_decoder_mode")
>Reviewed-by: Dave Jiang <dave.jiang@intel.com>
>Reviewed-by: Alison Schofield <alison.schofield@intel.com>
>Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
>Signed-off-by: Richard Cheng <icheng@nvidia.com>

Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>

>---
> drivers/cxl/core/region.c | 7 ++-----
> 1 file changed, 2 insertions(+), 5 deletions(-)
>
>diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
>index 042356c71ed7..4869cdd6a3d4 100644
>--- a/drivers/cxl/core/region.c
>+++ b/drivers/cxl/core/region.c
>@@ -2931,7 +2931,6 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
> {
> 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
> 	const struct resource *res;
>-	struct resource *p, *last;
> 	u64 offset, length;
> 	int rc = 0;
>
>@@ -2944,10 +2943,8 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
> 	 */
> 	for (int i = ctx->part; i < cxlds->nr_partitions; i++) {
> 		res = &cxlds->part[i].res;
>-		for (p = res->child, last = NULL; p; p = p->sibling)
>-			last = p;
>-		if (last)
>-			offset = last->end + 1;
>+		if (i == ctx->part)
>+			offset = ctx->offset;
> 		else
> 			offset = res->start;
> 		length = res->end - offset + 1;
>-- 
>2.43.0
>

[PATCH v8 4/4] cxl/memdev: Don't overwrite the error from an earlier partition poison query

[Richard Cheng]

cxl_get_poison_by_memdev() queries Get Poison List per partition but
never checks the result inside the loop, so a later partition's success
overwrites an earlier partition's failure and the whole scan reports
success while that partition's poison went unlisted. Before the loop
conversion the PMEM query returned early on error. Stop the loop on any
error not already tolerated as a RAM -EFAULT.

Fixes: be5cbd084027 ("cxl: Kill enum cxl_decoder_mode")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Closes: https://sashiko.dev/#/patchset/20260708074228.43654-1-icheng@nvidia.com?part=5
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/memdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
index b3419df586b9..e39b3d13fd56 100644
--- a/drivers/cxl/core/memdev.c
+++ b/drivers/cxl/core/memdev.c
@@ -231,6 +231,8 @@ static int cxl_get_poison_by_memdev(struct cxl_memdev *cxlmd)
 		 */
 		if (rc == -EFAULT && cxlds->part[i].mode == CXL_PARTMODE_RAM)
 			rc = 0;
+		if (rc)
+			break;
 	}
 	return rc;
 }
-- 
2.43.0

Re: [PATCH v8 4/4] cxl/memdev: Don't overwrite the error from an earlier partition poison query

[Davidlohr Bueso]

On Tue, 22 Sep 2026, Richard Cheng wrote:

>cxl_get_poison_by_memdev() queries Get Poison List per partition but
>never checks the result inside the loop, so a later partition's success
>overwrites an earlier partition's failure and the whole scan reports
>success while that partition's poison went unlisted. Before the loop
>conversion the PMEM query returned early on error. Stop the loop on any
>error not already tolerated as a RAM -EFAULT.
>
>Fixes: be5cbd084027 ("cxl: Kill enum cxl_decoder_mode")
>Reviewed-by: Dave Jiang <dave.jiang@intel.com>
>Reviewed-by: Alison Schofield <alison.schofield@intel.com>
>Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
>Closes: https://sashiko.dev/#/patchset/20260708074228.43654-1-icheng@nvidia.com?part=5
>Signed-off-by: Richard Cheng <icheng@nvidia.com>

Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>

... with a nit below.

>---
> drivers/cxl/core/memdev.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
>index b3419df586b9..e39b3d13fd56 100644
>--- a/drivers/cxl/core/memdev.c
>+++ b/drivers/cxl/core/memdev.c
>@@ -231,6 +231,8 @@ static int cxl_get_poison_by_memdev(struct cxl_memdev *cxlmd)
> 		 */
> 		if (rc == -EFAULT && cxlds->part[i].mode == CXL_PARTMODE_RAM)

This wants poison_efault_forgiven() - maybe move out of region.c into core.h?

> 			rc = 0;
>+		if (rc)
>+			break;
> 	}
> 	return rc;
> }
>-- 
>2.43.0
>