Re: [PATCH v5 2/6] cxl/test: Add type2 support for mock CFMWS0

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] alloc_mock_res() unconditionally dereferences `res` even if kzalloc() fails, and leaks `res` if gen_pool_alloc_algo() fails.
--

commit e10eed6f5b8f0ab41fd5d070bd75f2b5f0d1bef4
Author: Dave Jiang <dave.jiang@intel.com>

cxl/test: Add type2 support for mock CFMWS0

This commit adds a type2_test module parameter for triggering type 2 test
support in cxl_test. It also updates the CFMWS0 configuration to be type 2
when the parameter is set.

> diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c
> index 1c8ac8bdd8f7a..c5529cee482d4 100644
> --- a/tools/testing/cxl/test/cxl.c
> +++ b/tools/testing/cxl/test/cxl.c
[ ... ]
> @@ -493,10 +512,14 @@ static int populate_cedt(void)
>  		chbs->length = size;
>  	}
>  
> +	if (type2_test)
> +		update_type2_cfmws();
> +
>  	for (i = cfmws_start; i <= cfmws_end; i++) {
>  		struct acpi_cedt_cfmws *window = mock_cfmws[i];
>  
> -		cfmws_elc_update(window, i);
> +		if (i == 0 && !type2_test)
> +			cfmws_elc_update(window, i);
>  		res = alloc_mock_res(window->window_size, SZ_256M);

[Severity: High]
This is a pre-existing issue, but I noticed a potential problem in
alloc_mock_res() which is called here.

Does alloc_mock_res() unconditionally dereference the allocation before 
checking for success? Looking at the function:

alloc_mock_res() {
    struct cxl_mock_res *res = kzalloc(sizeof(*res), GFP_KERNEL);
    ...
    INIT_LIST_HEAD(&res->list);
}

If kzalloc() returns NULL, won't INIT_LIST_HEAD() cause an immediate NULL 
pointer dereference?

Additionally, if the subsequent memory pool allocation fails:

alloc_mock_res() {
    ...
    phys = gen_pool_alloc_algo(cxl_mock_pool, size,
                               gen_pool_first_fit_align, &data);
    if (!phys)
        return NULL;
}

Does this leak the memory allocated for res by returning NULL without calling
kfree(res)?

>  		if (!res)
>  			return -ENOMEM;
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611234409.256765-1-dave.jiang@intel.com?part=2