Re: [PATCH v7 1/2 RESEND] cxl/hdm: Allow zero sized HDM decoders

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] cxl_dpa_free() returns early for zero-sized decoders, bypassing resource release, leaking the DPA reservation, and permanently breaking port LIFO teardown.
--

--- Patch [1]: [PATCH v7 1/2 RESEND] cxl/hdm: Allow zero sized HDM decoders ---
commit 69f9a310ab608be9b469a96819d45389f215c346
Author: Richard Cheng <icheng@nvidia.com>

cxl/hdm: Allow zero sized HDM decoders

This commit allows the CXL subsystem to accept zero-sized HDM decoders
instead of rejecting them during port enumeration. It treats empty decoders
as first-class by backing them with a kmalloc'd resource and keeping the
skip and hdm_end accounting intact.

> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c

[ ... ]

> @@ -545,7 +569,7 @@ int cxl_dpa_free(struct cxl_endpoint_decoder *cxled)
>  	struct device *dev = &cxled->cxld.dev;
>  
>  	guard(rwsem_write)(&cxl_rwsem.dpa);
> -	if (!cxled->dpa_res)
> +	if (cxled_empty(cxled))

[Severity: High]
Does this early return skip the necessary cleanup for zero-sized decoders?

When cxled_empty(cxled) evaluates to true for a zero-sized decoder that
has a valid dpa_res, returning 0 here skips devm_cxl_dpa_release().
Since the reservation is backed by a kmalloc'd resource from
cxl_dpa_request_region(), does this leak the dpa_res memory?

Additionally, skipping devm_cxl_dpa_release() means port->hdm_end is not
decremented. Because CXL DPA management strictly enforces LIFO teardown,
will this strand the hdm_end watermark and permanently break the ability
to free or reconfigure prior decoders on the same port?

>  		return 0;
>  	if (cxled->cxld.region) {
>  		dev_dbg(dev, "decoder assigned to: %s\n",

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721085715.39322-1-icheng@nvidia.com?part=1