Re: [PATCH v6 1/2] cxl/hdm: Allow zero sized HDM decoders

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] cxl_dpa_free() returns early for zero-sized decoders, permanently stranding their DPA reservation and breaking LIFO decoder teardown.
--

commit 0afce63a5399c17fcedf2e4f736d16ed9b2f7179
Author: Richard Cheng <icheng@nvidia.com>

cxl/hdm: Allow zero sized HDM decoders

This commit allows empty (zero-sized) HDM decoders to be treated as first
class instead of being rejected. It backs them with a kmalloc'd resource
since the resource tree cannot represent an empty range, while keeping the
skip and hdm_end accounting intact.

> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> index 0c80b76a5f9b4..ccbab2e21f060 100644
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c
[ ... ]
> @@ -545,7 +569,7 @@ int cxl_dpa_free(struct cxl_endpoint_decoder *cxled)
>  	struct device *dev = &cxled->cxld.dev;
>  
>  	guard(rwsem_write)(&cxl_rwsem.dpa);
> -	if (!cxled->dpa_res)
> +	if (cxled_empty(cxled))
>  		return 0;

[Severity: High]
Does this early return permanently strand the DPA reservation and break LIFO
decoder teardown for zero-sized decoders?

By returning early for zero-sized decoders here, the cleanup logic inside
devm_cxl_dpa_release() is bypassed. This means the kmalloc'd 0-size
resource and any associated skip range aren't freed, and port->hdm_end is
not decremented.

Consequently, any attempt to resize a zero-sized decoder would fail with
-EBUSY because the reservation isn't actually freed. Attempting to free any
lower-indexed decoder would also fail with -EBUSY due to the port->hdm_end
ID mismatch.

>  	if (cxled->cxld.region) {
>  		dev_dbg(dev, "decoder assigned to: %s\n",
>  			dev_name(&cxled->cxld.region->dev));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625092857.41139-1-icheng@nvidia.com?part=1