[PATCH 0/2] cxl: fortify string fixups

[PATCH 0/2] cxl: fortify string fixups

[Dan Williams]

It seems nobody is running cxl_test with CONFIG_FORTIFY_SOURCE=y. A
couple instances of __fortify_panic can be triggered.

Move some counted_by initialization before associated buffer /
object-array access so that it does not falsely assume a buffer overflow
is occurring.

Dan Williams (2):
  cxl/fwctl: Fix __fortify_panic
  cxl/test: Fix __fortify_panic

 drivers/cxl/core/features.c            | 2 +-
 tools/testing/cxl/test/cxl_translate.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)


base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8
-- 
2.53.0

[PATCH 1/2] cxl/fwctl: Fix __fortify_panic

[Dan Williams]

Fix a runtime assertion in cxlctl_get_supported_features(). Fortify
complains that it is potentially overflowing the entries array per
__counted_by_le(num_entries). Quiet the false positive by initializing
@num_entries earlier.

 memcpy: detected buffer overflow: 48 byte write of buffer size 0
 WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#7: fwctl/1398
 RIP: 0010:__fortify_report+0x50/0xa0
 Call Trace:
  __fortify_panic+0xd/0xf
  cxlctl_get_supported_features.cold+0x23/0x35 [cxl_core]

Fixes: 4d1c09cef2c2 ("cxl: Add support for fwctl RPC command to enable CXL feature commands")
Signed-off-by: Dan Williams <djbw@kernel.org>
---
 drivers/cxl/core/features.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c
index 3435db9ea6b1..85185af46b72 100644
--- a/drivers/cxl/core/features.c
+++ b/drivers/cxl/core/features.c
@@ -423,6 +423,7 @@ static void *cxlctl_get_supported_features(struct cxl_features_state *cxlfs,
 
 	rpc_out->size = struct_size(feat_out, ents, requested);
 	feat_out = &rpc_out->get_sup_feats_out;
+	feat_out->num_entries = cpu_to_le16(requested);
 
 	for (i = start, pos = &feat_out->ents[0];
 	     i < cxlfs->entries->num_features; i++, pos++) {
@@ -444,7 +445,6 @@ static void *cxlctl_get_supported_features(struct cxl_features_state *cxlfs,
 		}
 	}
 
-	feat_out->num_entries = cpu_to_le16(requested);
 	feat_out->supported_feats = cpu_to_le16(cxlfs->entries->num_features);
 	rpc_out->retval = CXL_MBOX_CMD_RC_SUCCESS;
 	*out_len = out_size;
-- 
2.53.0

Re: [PATCH 1/2] cxl/fwctl: Fix __fortify_panic

[Dave Jiang]

On 5/19/26 3:12 PM, Dan Williams wrote:
> Fix a runtime assertion in cxlctl_get_supported_features(). Fortify
> complains that it is potentially overflowing the entries array per
> __counted_by_le(num_entries). Quiet the false positive by initializing
> @num_entries earlier.
> 
>  memcpy: detected buffer overflow: 48 byte write of buffer size 0
>  WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#7: fwctl/1398
>  RIP: 0010:__fortify_report+0x50/0xa0
>  Call Trace:
>   __fortify_panic+0xd/0xf
>   cxlctl_get_supported_features.cold+0x23/0x35 [cxl_core]
> 
> Fixes: 4d1c09cef2c2 ("cxl: Add support for fwctl RPC command to enable CXL feature commands")
> Signed-off-by: Dan Williams <djbw@kernel.org>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>


> ---
>  drivers/cxl/core/features.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c
> index 3435db9ea6b1..85185af46b72 100644
> --- a/drivers/cxl/core/features.c
> +++ b/drivers/cxl/core/features.c
> @@ -423,6 +423,7 @@ static void *cxlctl_get_supported_features(struct cxl_features_state *cxlfs,
>  
>  	rpc_out->size = struct_size(feat_out, ents, requested);
>  	feat_out = &rpc_out->get_sup_feats_out;
> +	feat_out->num_entries = cpu_to_le16(requested);
>  
>  	for (i = start, pos = &feat_out->ents[0];
>  	     i < cxlfs->entries->num_features; i++, pos++) {
> @@ -444,7 +445,6 @@ static void *cxlctl_get_supported_features(struct cxl_features_state *cxlfs,
>  		}
>  	}
>  
> -	feat_out->num_entries = cpu_to_le16(requested);
>  	feat_out->supported_feats = cpu_to_le16(cxlfs->entries->num_features);
>  	rpc_out->retval = CXL_MBOX_CMD_RC_SUCCESS;
>  	*out_len = out_size;

Re: [PATCH 1/2] cxl/fwctl: Fix __fortify_panic

[Alison Schofield]

On Tue, May 19, 2026 at 03:12:03PM -0700, Dan Williams wrote:
> Fix a runtime assertion in cxlctl_get_supported_features(). Fortify
> complains that it is potentially overflowing the entries array per
> __counted_by_le(num_entries). Quiet the false positive by initializing
> @num_entries earlier.
> 
>  memcpy: detected buffer overflow: 48 byte write of buffer size 0
>  WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#7: fwctl/1398
>  RIP: 0010:__fortify_report+0x50/0xa0
>  Call Trace:
>   __fortify_panic+0xd/0xf
>   cxlctl_get_supported_features.cold+0x23/0x35 [cxl_core]
> 

Reviewed-by: Alison Schofield <alison.schofield@intel.com>

[PATCH 2/2] cxl/test: Fix __fortify_panic

[Dan Williams]

Fix a runtime assertion in setup_xor_mapping(). Fortify complains that it
is potentially overflowing the xormaps array per __counted_by(nr_maps).
Quiet the false positive by initializing @nr_entries earlier.

 memcpy: detected buffer overflow: 32 byte write of buffer size 0
 WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#8: modprobe/2728
 Call Trace:
  __fortify_panic+0xd/0xf
  setup_xor_mapping+0x6c/0xa0 [cxl_translate]

Fixes: 06377c54a133 ("cxl/test: Add cxl_translate module for address translation testing")
Signed-off-by: Dan Williams <djbw@kernel.org>
---
 tools/testing/cxl/test/cxl_translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/cxl/test/cxl_translate.c b/tools/testing/cxl/test/cxl_translate.c
index 16328b2112b2..25a27e01ac21 100644
--- a/tools/testing/cxl/test/cxl_translate.c
+++ b/tools/testing/cxl/test/cxl_translate.c
@@ -236,8 +236,8 @@ static int setup_xor_mapping(void)
 	if (!cximsd)
 		return -ENOMEM;
 
-	memcpy(cximsd->xormaps, xormaps, nr_maps * sizeof(*cximsd->xormaps));
 	cximsd->nr_maps = nr_maps;
+	memcpy(cximsd->xormaps, xormaps, nr_maps * sizeof(*cximsd->xormaps));
 
 	return 0;
 }
-- 
2.53.0

Re: [PATCH 2/2] cxl/test: Fix __fortify_panic

[Dave Jiang]

On 5/19/26 3:12 PM, Dan Williams wrote:
> Fix a runtime assertion in setup_xor_mapping(). Fortify complains that it
> is potentially overflowing the xormaps array per __counted_by(nr_maps).
> Quiet the false positive by initializing @nr_entries earlier.

@nr_maps?


> 
>  memcpy: detected buffer overflow: 32 byte write of buffer size 0
>  WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#8: modprobe/2728
>  Call Trace:
>   __fortify_panic+0xd/0xf
>   setup_xor_mapping+0x6c/0xa0 [cxl_translate]
> 
> Fixes: 06377c54a133 ("cxl/test: Add cxl_translate module for address translation testing")
> Signed-off-by: Dan Williams <djbw@kernel.org>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>


> ---
>  tools/testing/cxl/test/cxl_translate.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/testing/cxl/test/cxl_translate.c b/tools/testing/cxl/test/cxl_translate.c
> index 16328b2112b2..25a27e01ac21 100644
> --- a/tools/testing/cxl/test/cxl_translate.c
> +++ b/tools/testing/cxl/test/cxl_translate.c
> @@ -236,8 +236,8 @@ static int setup_xor_mapping(void)
>  	if (!cximsd)
>  		return -ENOMEM;
>  
> -	memcpy(cximsd->xormaps, xormaps, nr_maps * sizeof(*cximsd->xormaps));
>  	cximsd->nr_maps = nr_maps;
> +	memcpy(cximsd->xormaps, xormaps, nr_maps * sizeof(*cximsd->xormaps));
>  
>  	return 0;
>  }

Re: [PATCH 2/2] cxl/test: Fix __fortify_panic

[Alison Schofield]

On Tue, May 19, 2026 at 03:12:04PM -0700, Dan Williams wrote:
> Fix a runtime assertion in setup_xor_mapping(). Fortify complains that it
> is potentially overflowing the xormaps array per __counted_by(nr_maps).
> Quiet the false positive by initializing @nr_entries earlier.
> 
>  memcpy: detected buffer overflow: 32 byte write of buffer size 0
>  WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#8: modprobe/2728
>  Call Trace:
>   __fortify_panic+0xd/0xf
>   setup_xor_mapping+0x6c/0xa0 [cxl_translate]


Reviewed-by: Alison Schofield <alison.schofield@intel.com>

Re: [PATCH 0/2] cxl: fortify string fixups

[Alison Schofield]

On Tue, May 19, 2026 at 03:12:02PM -0700, Dan Williams wrote:
> It seems nobody is running cxl_test with CONFIG_FORTIFY_SOURCE=y. A

Added now:
ci-base.cfg: enable CONFIG_FORTIFY_SOURCE
https://github.com/pmem/ndctl-test-runner/commit/7b4e823

Re: [PATCH 0/2] cxl: fortify string fixups

[Dave Jiang]

On 5/19/26 3:12 PM, Dan Williams wrote:
> It seems nobody is running cxl_test with CONFIG_FORTIFY_SOURCE=y. A
> couple instances of __fortify_panic can be triggered.
> 
> Move some counted_by initialization before associated buffer /
> object-array access so that it does not falsely assume a buffer overflow
> is occurring.
> 
> Dan Williams (2):
>   cxl/fwctl: Fix __fortify_panic
>   cxl/test: Fix __fortify_panic
> 
>  drivers/cxl/core/features.c            | 2 +-
>  tools/testing/cxl/test/cxl_translate.c | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> 
> base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8

Applied to cxl/next with commit 2 commit log fixed up.

b882b0ca9bf8
5c00984479bb