Re: [PATCH 3/4] cxl/mbox: Treat unknown device return codes as errors

[Jonathan Cameron <jic23@kernel.org>]

On Tue, 13 Oct 2026 21:17:54 -0700
Alison Schofield <alison.schofield@intel.com> wrote:

> From: Gaobin Huang <huanggaobin23@semi.ac.cn>
> 
> cxl_mbox_cmd_rc2errno() and cxl_mbox_cmd_rc2str() use the device's 16-bit
> return code to index cxl_mbox_cmd_rctable[]. A return code outside the
> table's range causes an out-of-bounds read, potentially allowing a failed
> command to be reported as successful.
> 
> Check the return code against the table size. Report unknown codes as
> -ENXIO, the errno used for most device-reported errors, and describe them
> as "unknown return code".
> 
> Found with a QEMU Type-3 device returning codes 001Fh and 0020h, which are defined in CXL 4.0 but not yet recognized by Linux [1].
> 
> [1] https://lore.kernel.org/linux-cxl/20260929060747.3550005-1-huanggaobin23@semi.ac.cn/
> 
> Fixes: 92fcc1abab09 ("cxl/mbox: Improve handling of mbox_cmd hw return codes")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gaobin Huang <huanggaobin23@semi.ac.cn>
> Co-developed-by: Alison Schofield <alison.schofield@intel.com>
> Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>