Re: [PATCH v28 2/5] cxl/sfc: Map cxl regs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] `cxl_probe_component_regs()` performs unvalidated reads on the CXL component register block, which can cause a kernel panic if a malformed PCIe device exposes a small or truncated register block.
--

commit 0e4acdaa76943d29ebab4e0ccea9ab0230622629
Author: Alejandro Lucero <alucerop@amd.com>

cxl/sfc: Map cxl regs

Export cxl core functions for a Type2 driver being able to discover and
map the device registers.

Use it in sfc driver cxl initialization.

> diff --git a/drivers/net/ethernet/sfc/efx_cxl.c b/drivers/net/ethernet/sfc/efx_cxl.c
> index be252af972ab3..704b0ebae9374 100644
> --- a/drivers/net/ethernet/sfc/efx_cxl.c
> +++ b/drivers/net/ethernet/sfc/efx_cxl.c
[ ... ]
> @@ -42,6 +45,29 @@ int efx_cxl_init(struct efx_probe_data *probe_data)
>  	if (!cxl)
>  		return -ENOMEM;
>  
> +	rc = cxl_pci_setup_regs(pci_dev, CXL_REGLOC_RBI_COMPONENT,
> +				&cxl->cxlds.reg_map);

[Severity: High]
This is a pre-existing issue, but when discovering the CXL register blocks,
cxl_decode_regblock() in drivers/cxl/core/regs.c computes the size of the
block as:

map->max_size = pci_resource_len(pdev, bar) - offset;

If a malicious or buggy device presents a Register Locator DVSEC with an
offset close to the end of the PCI BAR, map->max_size could be very small.

Later, cxl_probe_component_regs() blindly advances the base pointer by
CXL_CM_OFFSET (0x1000) and attempts to read the capability array:

base += CXL_CM_OFFSET;
cap_array = readl(base + CXL_CM_CAP_HDR_OFFSET);

Are there any bounds checks verifying that map->max_size is large enough
before these reads occur, or can this cause an out-of-bounds I/O memory
read and a kernel panic if a malformed PCIe device exposes a truncated
register block?

> +	if (rc) {
> +		pci_err(pci_dev, "No component registers\n");
> +		return rc;
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260618181806.118745-1-alejandro.lucero-palau@amd.com?part=2