Re: [PATCH] cxl/features: Serialize multi-part Get/Set Feature transfers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Buffer overflow in `cxl_get_feature()` due to static `size_out` usage in multi-part transfers.
--

--- Patch [1]: [PATCH] cxl/features: Serialize multi-part Get/Set Feature transfers ---
commit a8495b40ab103b124442f90daa5b684383d16566
Author: Dave Jiang <dave.jiang@intel.com>

cxl/features: Serialize multi-part Get/Set Feature transfers

This patch introduces a per-mailbox feat_mutex to serialize multi-part
Get and Set Feature payload transfers. This ensures that concurrent accesses
from fwctl and EDAC paths cannot interleave parts and corrupt the device's
transfer context.

Link: https://sashiko.dev/#/patchset/20260702090849.47501-1-icheng@nvidia.com?part=1
Fixes: 5e5ac21f629d ("cxl/mbox: Add GET_FEATURE mailbox command")
Fixes: 14d502cc2718 ("cxl/mbox: Add SET_FEATURE mailbox command")

> diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c
> index 85185af46b72d..85d6bcdc360ef 100644
> --- a/drivers/cxl/core/features.c
> +++ b/drivers/cxl/core/features.c
> @@ -240,6 +240,8 @@ size_t cxl_get_feature(struct cxl_mailbox *cxl_mbox, const uuid_t *feat_uuid,
>  	size_out = min(feat_out_size, cxl_mbox->payload_size);
>  	uuid_copy(&pi.uuid, feat_uuid);
>  	pi.selection = selection;
> +
> +	guard(mutex)(&cxl_mbox->feat_mutex);
>  	do {
>  		data_to_rd_size = min(feat_out_size - data_rcvd_size,
>  				      cxl_mbox->payload_size);

[Severity: Critical]
This is a pre-existing issue, but does this static size_out assignment risk
a buffer overflow on the final iteration?

In cxl_get_feature(), mbox_cmd.size_out is assigned the initial size_out
value on every loop iteration, rather than the dynamically bounded
data_to_rd_size:

		mbox_cmd = (struct cxl_mbox_cmd) {
			.opcode = CXL_MBOX_OP_GET_FEATURE,
			.size_in = sizeof(pi),
			.payload_in = &pi,
			.size_out = size_out,
			.payload_out = feat_out + data_rcvd_size,
			.min_out = data_to_rd_size,
		};

If the hardware returns more bytes than requested on the final iteration,
could the transport use this larger size_out bound to copy past the end of
the feat_out buffer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709155841.1895915-1-dave.jiang@intel.com?part=1