Re: [PATCH 3/4] cxl/mbox: Treat unknown device return codes as errors

[Alison Schofield <alison.schofield@intel.com>]

On Thu, Oct 15, 2026 at 05:22:02PM +0800, Li Ming wrote:
> 
> 在 2026/10/14 12:17, Alison Schofield 写道:
> > From: Gaobin Huang <huanggaobin23@semi.ac.cn>
> > 
> > cxl_mbox_cmd_rc2errno() and cxl_mbox_cmd_rc2str() use the device's 16-bit
> > return code to index cxl_mbox_cmd_rctable[]. A return code outside the
> > table's range causes an out-of-bounds read, potentially allowing a failed
> > command to be reported as successful.
> > 
> > Check the return code against the table size. Report unknown codes as
> > -ENXIO, the errno used for most device-reported errors, and describe them
> > as "unknown return code".
> > 
> > Found with a QEMU Type-3 device returning codes 001Fh and 0020h, which are defined in CXL 4.0 but not yet recognized by Linux [1].
> > 
> > [1] https://lore.kernel.org/linux-cxl/20260929060747.3550005-1-huanggaobin23@semi.ac.cn/
> > 
> > Fixes: 92fcc1abab09 ("cxl/mbox: Improve handling of mbox_cmd hw return codes")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Gaobin Huang <huanggaobin23@semi.ac.cn>
> > Co-developed-by: Alison Schofield <alison.schofield@intel.com>
> > Signed-off-by: Alison Schofield <alison.schofield@intel.com>
> Reviewed-by: Li Ming <ming.li@zohomail.com>
> 
> 
> The issue is not related this patch, but I found it during reviewing this
> patchset.
> 
> I noticed that the default errno of CXL_MBOX_CMD_RC_BACKGROUND is -ENXIO,
> but description is "background cmd started successfully", I checked no any
> driver code checks/uses this CXL_MBOX_CMD_RC_BACKGROUND's errno, maybe we
> should set to 0 like CXL_MBOX_CMD_RC_SUCCESS?
> 

Hi Ming,

Agree. Fixing it to 0 seems like a separate cleanup, not for this
series. Can you send a separate patch for that?

-- Alison


 > ---
> > 
> > This patch is independently applicable and backportable. It is
> > intentionally introduced here as a lead in to the kunit patch
> > that backstops this fix.
> > 
> > 
> >   drivers/cxl/cxlmem.h | 6 ++++++
> >   1 file changed, 6 insertions(+)
> > 
> > diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h
> > index c401e3a1af06..357d0d873e87 100644
> > --- a/drivers/cxl/cxlmem.h
> > +++ b/drivers/cxl/cxlmem.h
> > @@ -6,6 +6,7 @@
> >   #include <linux/pci.h>
> >   #include <linux/cdev.h>
> >   #include <linux/uuid.h>
> > +#include <linux/array_size.h>
> >   #include <linux/node.h>
> >   #include <cxl/event.h>
> >   #include <cxl/mailbox.h>
> > @@ -205,13 +206,18 @@ static const
> >   struct cxl_mbox_cmd_rc cxl_mbox_cmd_rctable[] ={ CMD_CMD_RC_TABLE };
> >   #undef C
> > +/* The return code comes from the device and may be one this table lacks */
> >   static inline const char *cxl_mbox_cmd_rc2str(struct cxl_mbox_cmd *mbox_cmd)
> >   {
> > +	if (mbox_cmd->return_code >= ARRAY_SIZE(cxl_mbox_cmd_rctable))
> > +		return "unknown return code";
> >   	return cxl_mbox_cmd_rctable[mbox_cmd->return_code].desc;
> >   }
> >   static inline int cxl_mbox_cmd_rc2errno(struct cxl_mbox_cmd *mbox_cmd)
> >   {
> > +	if (mbox_cmd->return_code >= ARRAY_SIZE(cxl_mbox_cmd_rctable))
> > +		return -ENXIO;
> >   	return cxl_mbox_cmd_rctable[mbox_cmd->return_code].err;
> >   }