Re: [PATCH v2] cxl/pci: Honor -EPROBE_DEFER from component register setup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] cxl_pci_type3_init_mailbox() incorrectly evaluates component_map.ras.valid instead of device_map.mbox.valid to check mailbox presence, leading to kernel panics or functional regressions.
--

--- Patch [1]: [PATCH v2] cxl/pci: Honor -EPROBE_DEFER from component register setup ---
commit 04637d8b82b95fbc354ce623ffbeb09e3d57ae3e
Author: Dave Jiang <dave.jiang@intel.com>

cxl/pci: Honor -EPROBE_DEFER from component register setup

cxl_pci_setup_regs() can return -EPROBE_DEFER on a Restricted CXL Host (RCD)
when the upstream port has not yet been enumerated. This patch ensures that
cxl_pci_probe() returns -EPROBE_DEFER instead of continuing so the probe is
retried once the upstream port is available.

Link: https://lore.kernel.org/linux-cxl/ajzhsubot_PSYtHQ@MWDK4CY14F/T/#m063bbf76b1c9c293ade52ab311018ae6bba11a44

> diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c
> index 267c679b0b3c2..6a132a6c4c5b3 100644
> --- a/drivers/cxl/pci.c
> +++ b/drivers/cxl/pci.c
> @@ -829,10 +829,13 @@ static int cxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  	 */
>  	rc = cxl_pci_setup_regs(pdev, CXL_REGLOC_RBI_COMPONENT,
>  				&cxlds->reg_map);
> -	if (rc)
> +	if (rc) {
> +		if (rc == -EPROBE_DEFER)
> +			return rc;
>  		dev_warn(&pdev->dev, "No component registers (%d)\n", rc);
> -	else if (!cxlds->reg_map.component_map.ras.valid)
> +	} else if (!cxlds->reg_map.component_map.ras.valid) {
>  		dev_dbg(&pdev->dev, "RAS registers not found\n");
> +	}
>  
>  	rc = cxl_pci_type3_init_mailbox(cxlds);
>  	if (rc)

[Severity: High]
This isn't a bug introduced by this patch, but looking at the mailbox
initialization, cxl_pci_type3_init_mailbox() checks the mbox valid flag:

drivers/cxl/pci.c:cxl_pci_type3_init_mailbox() {
    if (!cxlds->reg_map.device_map.mbox.valid)
        return -ENODEV;
    ...
}

Since cxl_pci_setup_regs() was just called above with
CXL_REGLOC_RBI_COMPONENT and populated cxlds->reg_map, does this mailbox
check inadvertently evaluate component_map.ras.valid due to the union
in struct cxl_register_map?

If a device lacks a mailbox but has RAS registers, could the presence
check incorrectly pass?

drivers/cxl/pci.c:cxl_pci_setup_mailbox() {
    ...
    const int cap = readl(cxlds->regs.mbox + CXLDEV_MBOX_CAPS_OFFSET);
    ...
}

Would this lead to a null pointer dereference in cxl_pci_setup_mailbox()
because cxlds->regs.mbox is null?

Conversely, if a device has a valid mailbox but no RAS registers,
would cxl_pci_type3_init_mailbox() incorrectly return -ENODEV and fail the
probe of a functional device?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706224322.714934-1-dave.jiang@intel.com?part=1