Re: [PATCH 1/9] cxl/region: Fix use-after-free from auto assembly failure

[Dan Williams <dan.j.williams@intel.com>]

Alison Schofield wrote:
> On Thu, Mar 26, 2026 at 10:28:13PM -0700, Dan Williams wrote:
> > The following crash signature results from region destruction while an
> > endpoint decoder is staged, but not fully attached.
> > 
> > ---
> >  BUG: KASAN: slab-use-after-free in __cxl_decoder_detach+0x724/0x830 [cxl_core]
> >  Read of size 8 at addr ffff888265638840 by task modprobe/1287
> > 
> >  Call Trace:
> >   <TASK>
> >   dump_stack_lvl+0x68/0x90
> >   print_report+0x170/0x4e2
> >   kasan_report+0xc2/0x1a0
> >   __cxl_decoder_detach+0x724/0x830 [cxl_core]
> >   cxl_decoder_detach+0x6c/0x100 [cxl_core]
> >   unregister_region+0x88/0x140 [cxl_core]
> >   devres_release_all+0x172/0x230
> > ---
> > 
> > The "staged" state is established by cxl_region_attach_auto() and finalized
> > by cxl_region_attach_position(). When that is finalized a memdev removal
> > event will destroy regions before endpoint decoders. However, in the
> > interim the memdev removal will falsely assume that the endpoint decoder is
> > unattached. Later, the eventual region removal finds the stale pointer to
> > the now freed endpoint decoder.
> 
> I'm wondering how this is exposed. What is 'eventual region removal'? 
> 
> The region driver does not clean up after failed auto assembly.
> The cxl-cli cannot because topology is broken.
> 
> How did you get here?

tl;dr: "modprobe -r cxl_test"

When the cxl_acpi driver is removed the CXL Window root decoders are
destroyed along with any regions that were in the process of being
created.

If one of the region's to be cleaned up has a p->targets[] entry setup
by cxl_region_attach_auto(), but not finalized by
cxl_region_attach_position() then there is nothing to stop that @cxled
object from being freed.

The "modprobe -r cxl_test" event destroys all the memdevs. When the
memdev goes to free its decoders it sees that @cxled->cxld.region is not
yet set, assumes it is idle and frees it. Later, unregister_region()
sees the now freed @cxled in its p->targets[] list, tries to
de-reference it and boom.