From: Alison Schofield <alison.schofield@intel.com>
To: Davidlohr Bueso <dave@stgolabs.net>,
Jonathan Cameron <jonathan.cameron@huawei.com>,
Dave Jiang <dave.jiang@intel.com>,
Alison Schofield <alison.schofield@intel.com>,
Vishal Verma <vishal.l.verma@intel.com>,
Ira Weiny <ira.weiny@intel.com>,
Dan Williams <dan.j.williams@intel.com>
Cc: linux-cxl@vger.kernel.org
Subject: [PATCH] cxl/acpi: Restore HBIW check before dereferencing platform_data
Date: Fri, 9 Jan 2026 11:49:44 -0800 [thread overview]
Message-ID: <20260109194946.431083-1-alison.schofield@intel.com> (raw)
Commit 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available
for testing") split xormap handling code to create a reusable helper
function but inadvertently dropped the check of HBIW values before
dereferencing cxlrd->platform_data. When HBIW is 1 or 3, no xormaps
are needed and platform_data may be NULL, leading to a potential NULL
pointer dereference.
Affects platform configs using XOR Arithmetic with HBIWs of 1 or 3,
when performing DPA->HPA address translation for CXL events. Those
events would be any of poison ops, general media, or dram.
Restore the early return check for HBIW values of 1 and 3 before
dereferencing platform_data.
Fixes: 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available for testing")
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
---
This bug was introduced in 6.19-rc1 and found while rebasing this
work: cxl/region: Translate DPA->HPA in unaligned MOD3 regions.
Adding coverage for this to cxl-test suite is on my todo list.
drivers/cxl/acpi.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
index 77ac940e3013..49bba2b9a3c4 100644
--- a/drivers/cxl/acpi.c
+++ b/drivers/cxl/acpi.c
@@ -75,9 +75,16 @@ EXPORT_SYMBOL_FOR_MODULES(cxl_do_xormap_calc, "cxl_translate");
static u64 cxl_apply_xor_maps(struct cxl_root_decoder *cxlrd, u64 addr)
{
- struct cxl_cxims_data *cximsd = cxlrd->platform_data;
+ int hbiw = cxlrd->cxlsd.nr_targets;
+ struct cxl_cxims_data *cximsd;
- return cxl_do_xormap_calc(cximsd, addr, cxlrd->cxlsd.nr_targets);
+ /* No xormaps for host bridge interleave ways of 1 or 3 */
+ if (hbiw == 1 || hbiw == 3)
+ return addr;
+
+ cximsd = cxlrd->platform_data;
+
+ return cxl_do_xormap_calc(cximsd, addr, hbiw);
}
struct cxl_cxims_context {
base-commit: 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb
--
2.37.3
next reply other threads:[~2026-01-09 19:49 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-09 19:49 Alison Schofield [this message]
2026-01-10 0:11 ` [PATCH] cxl/acpi: Restore HBIW check before dereferencing platform_data Dave Jiang
2026-01-10 0:14 ` Dave Jiang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260109194946.431083-1-alison.schofield@intel.com \
--to=alison.schofield@intel.com \
--cc=dan.j.williams@intel.com \
--cc=dave.jiang@intel.com \
--cc=dave@stgolabs.net \
--cc=ira.weiny@intel.com \
--cc=jonathan.cameron@huawei.com \
--cc=linux-cxl@vger.kernel.org \
--cc=vishal.l.verma@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox