[PATCH] cxl/region: Use %pa printk format to emit resource_size_t

[PATCH] cxl/region: Use %pa printk format to emit resource_size_t

[Alison Schofield]

KASAN reports a stack-out-of-bounds access in validate_region_offset()
while running the cxl-poison.sh unit test because the printk format
specifier, %pr format, is not a match for the resource_size_t type of
the variables. %pr expects struct resource pointers and attempts to
dereference the structure fields, reading beyond the bounds of the
stack variables.

Since these messages emit  an 'A exceeds B' type of message, keep
the resource_size_t's and use the %pa specifier to be architecture
safe.

BUG: KASAN: stack-out-of-bounds in resource_string.isra.0+0xe9a/0x1690
[] Read of size 8 at addr ffff88800a7afb40 by task bash/1397
...
[] The buggy address belongs to stack of task bash/1397
[]  and is located at offset 56 in frame:
[]  validate_region_offset+0x0/0x1c0 [cxl_core]

Fixes: c3dd67681c70 ("cxl/region: Add inject and clear poison by region offset")
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
---
 drivers/cxl/core/region.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index e14c1d305b22..4e567f7e06bc 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -3666,14 +3666,14 @@ static int validate_region_offset(struct cxl_region *cxlr, u64 offset)
 
 	if (offset < p->cache_size) {
 		dev_err(&cxlr->dev,
-			"Offset %#llx is within extended linear cache %pr\n",
+			"Offset %#llx is within extended linear cache %pa\n",
 			offset, &p->cache_size);
 		return -EINVAL;
 	}
 
 	region_size = resource_size(p->res);
 	if (offset >= region_size) {
-		dev_err(&cxlr->dev, "Offset %#llx exceeds region size %pr\n",
+		dev_err(&cxlr->dev, "Offset %#llx exceeds region size %pa\n",
 			offset, &region_size);
 		return -EINVAL;
 	}

base-commit: 3a8660878839faadb4f1a6dd72c3179c1df56787
-- 
2.37.3

Re: [PATCH] cxl/region: Use %pa printk format to emit resource_size_t

[Dave Jiang]

On 10/14/25 12:31 AM, Alison Schofield wrote:
> KASAN reports a stack-out-of-bounds access in validate_region_offset()
> while running the cxl-poison.sh unit test because the printk format
> specifier, %pr format, is not a match for the resource_size_t type of
> the variables. %pr expects struct resource pointers and attempts to
> dereference the structure fields, reading beyond the bounds of the
> stack variables.
> 
> Since these messages emit  an 'A exceeds B' type of message, keep
> the resource_size_t's and use the %pa specifier to be architecture
> safe.
> 
> BUG: KASAN: stack-out-of-bounds in resource_string.isra.0+0xe9a/0x1690
> [] Read of size 8 at addr ffff88800a7afb40 by task bash/1397
> ...
> [] The buggy address belongs to stack of task bash/1397
> []  and is located at offset 56 in frame:
> []  validate_region_offset+0x0/0x1c0 [cxl_core]
> 
> Fixes: c3dd67681c70 ("cxl/region: Add inject and clear poison by region offset")
> Signed-off-by: Alison Schofield <alison.schofield@intel.com>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>> ---
>  drivers/cxl/core/region.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index e14c1d305b22..4e567f7e06bc 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c
> @@ -3666,14 +3666,14 @@ static int validate_region_offset(struct cxl_region *cxlr, u64 offset)
>  
>  	if (offset < p->cache_size) {
>  		dev_err(&cxlr->dev,
> -			"Offset %#llx is within extended linear cache %pr\n",
> +			"Offset %#llx is within extended linear cache %pa\n",
>  			offset, &p->cache_size);
>  		return -EINVAL;
>  	}
>  
>  	region_size = resource_size(p->res);
>  	if (offset >= region_size) {
> -		dev_err(&cxlr->dev, "Offset %#llx exceeds region size %pr\n",
> +		dev_err(&cxlr->dev, "Offset %#llx exceeds region size %pa\n",
>  			offset, &region_size);
>  		return -EINVAL;
>  	}
> 
> base-commit: 3a8660878839faadb4f1a6dd72c3179c1df56787

Re: [PATCH] cxl/region: Use %pa printk format to emit resource_size_t

[Dave Jiang]

On 10/14/25 12:31 AM, Alison Schofield wrote:
> KASAN reports a stack-out-of-bounds access in validate_region_offset()
> while running the cxl-poison.sh unit test because the printk format
> specifier, %pr format, is not a match for the resource_size_t type of
> the variables. %pr expects struct resource pointers and attempts to
> dereference the structure fields, reading beyond the bounds of the
> stack variables.
> 
> Since these messages emit  an 'A exceeds B' type of message, keep
> the resource_size_t's and use the %pa specifier to be architecture
> safe.
> 
> BUG: KASAN: stack-out-of-bounds in resource_string.isra.0+0xe9a/0x1690
> [] Read of size 8 at addr ffff88800a7afb40 by task bash/1397
> ...
> [] The buggy address belongs to stack of task bash/1397
> []  and is located at offset 56 in frame:
> []  validate_region_offset+0x0/0x1c0 [cxl_core]
> 
> Fixes: c3dd67681c70 ("cxl/region: Add inject and clear poison by region offset")
> Signed-off-by: Alison Schofield <alison.schofield@intel.com>

Applied to cxl/fixes

> ---
>  drivers/cxl/core/region.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index e14c1d305b22..4e567f7e06bc 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c
> @@ -3666,14 +3666,14 @@ static int validate_region_offset(struct cxl_region *cxlr, u64 offset)
>  
>  	if (offset < p->cache_size) {
>  		dev_err(&cxlr->dev,
> -			"Offset %#llx is within extended linear cache %pr\n",
> +			"Offset %#llx is within extended linear cache %pa\n",
>  			offset, &p->cache_size);
>  		return -EINVAL;
>  	}
>  
>  	region_size = resource_size(p->res);
>  	if (offset >= region_size) {
> -		dev_err(&cxlr->dev, "Offset %#llx exceeds region size %pr\n",
> +		dev_err(&cxlr->dev, "Offset %#llx exceeds region size %pa\n",
>  			offset, &region_size);
>  		return -EINVAL;
>  	}
> 
> base-commit: 3a8660878839faadb4f1a6dd72c3179c1df56787