Re: [PATCH v9 09/10] cxl/test: Add mock BI topology support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] cxl/test: Use-After-Free in mock_cxl_setup_hdm() on unbind/rebind
--

commit 943579b999ae7670b28d433527c8563008ab779f
Author: Davidlohr Bueso <dave@stgolabs.net>

    cxl/test: Add mock BI topology support
    
    Extend the mock topology with a Back-Invalidate path
    covering both the type3 memdevs and the type2 accelerator.

[ ... ]

    Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
    Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>

> diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c
> index 62bd92b3be45f..cddea44e780aa 100644
> --- a/tools/testing/cxl/test/cxl.c
> +++ b/tools/testing/cxl/test/cxl.c
[ ... ]
> @@ -736,10 +767,65 @@ static struct cxl_hdm *mock_cxl_setup_hdm(struct cxl_port *port,
>  	cxlhdm->port = port;
>  	cxlhdm->interleave_mask = ~0U;
>  	cxlhdm->iw_cap_mask = ~0UL;
> +
> +	/*
> +	 * A page of plain memory stands in for the HDM decoder register
> +	 * block: cxled_committed_bi() reads the per-decoder BI bit from
> +	 * it, which mock_decoder_commit()/reset() maintain below. All
> +	 * other consumers of these registers are bypassed by the mocked
> +	 * decoder setup and commit paths.
> +	 */
> +	cxlhdm->regs.hdm_decoder =
> +		(void __iomem *)devm_get_free_pages(dev,
> +						    GFP_KERNEL | __GFP_ZERO, 0);
> +	if (!cxlhdm->regs.hdm_decoder)
> +		return ERR_PTR(-ENOMEM);
> +
> +	/* likewise for the endpoint's BI Decoder block, BI Enable set */
> +	if (is_cxl_endpoint(port) && !port->regs.bi_decoder) {
> +		void __iomem *bi = (void __iomem *)
> +			devm_get_free_pages(dev, GFP_KERNEL | __GFP_ZERO, 0);
> +
> +		if (!bi)
> +			return ERR_PTR(-ENOMEM);
> +		writel(CXL_BI_DECODER_CTRL_BI_ENABLE,
> +		       bi + CXL_BI_DECODER_CTRL_OFFSET);
> +		port->regs.bi_decoder = bi;
> +	}

[Severity: Medium]
Could this lead to a use-after-free during a driver unbind/rebind cycle?

In mock_cxl_setup_hdm(), devm_get_free_pages() is used to allocate memory
for port->regs.bi_decoder. During a cxl_test unbind, devres will free this
memory, but the pointer remains set in the long-lived struct cxl_port. 

On a subsequent rebind, the condition !port->regs.bi_decoder will evaluate to
false, skipping the allocation of new memory. This leaves a dangling pointer
that could be dereferenced later by cxl_bi_decoder_enabled().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1790103847.git.dave@stgolabs.net?part=9