Re: [PATCH] cxl/mbox: Add the CXL 4.0 command return codes 001Fh and 0020h

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] cxl: OOB array access when parsing hardware return_code
--

commit 15edb1196288251867601cc5b50acf1789f0b357
Author: Gaobin Huang <huanggaobin23@semi.ac.cn>

cxl/mbox: Add the CXL 4.0 command return codes 001Fh and 0020h

This commit adds two new command return codes (001Fh and 0020h) from the CXL
r4.0 specification to the command return code table. A device reporting
either code was previously described as an unknown return code, and both are
now mapped to -ENXIO.

> diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h
> index c401e3a1af06f..43f29564c1050 100644
> --- a/drivers/cxl/cxlmem.h
> +++ b/drivers/cxl/cxlmem.h
> @@ -190,6 +190,8 @@ static inline struct cxl_ep *cxl_ep_load(struct cxl_port *port,
>  	C(FEATURETRANSFEROOO, -ENXIO, "feature transfer out of order"),		\
>  	C(RESOURCEEXHAUSTED, -ENXIO, "resources are exhausted"),		\
>  	C(EXTLIST, -ENXIO, "invalid Extent List"),				\
> +	C(TRANSFEROOO, -ENXIO, "transfer out of order"),			\
> +	C(REQABORTNOTSUP, -ENXIO, "request abort not supported"),		\
>  
>  #undef C
>  #define C(a, b, c) CXL_MBOX_CMD_RC_##a

[Severity: High]
Does this code overflow the cxl_mbox_cmd_rctable[] array if the hardware
returns an unknown code?

Since the return code is read directly from the hardware mailbox status
register:

drivers/cxl/pci.c:__cxl_pci_mbox_send_cmd()
	status_reg = readq(cxlds->regs.mbox + CXLDEV_MBOX_STATUS_OFFSET);
	mbox_cmd->return_code =
		FIELD_GET(CXLDEV_MBOX_STATUS_RET_CODE_MASK, status_reg);

Could a buggy or malicious CXL device return a 16-bit value that exceeds the
size of cxl_mbox_cmd_rctable[]?

When cxl_mbox_cmd_rc2str() or cxl_mbox_cmd_rc2errno() uses this untrusted
return code as an array index:

drivers/cxl/cxlmem.h:cxl_mbox_cmd_rc2str()
static inline const char *cxl_mbox_cmd_rc2str(struct cxl_mbox_cmd *mbox_cmd)
{
	return cxl_mbox_cmd_rctable[mbox_cmd->return_code].desc;
}

Could this result in an out-of-bounds access that crashes the kernel when
attempting to dereference the garbage .desc pointer, or return a garbage .err
value?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015055048.1765042-1-huanggaobin23@semi.ac.cn?part=1