[PATCH 1/3] cxl/region: Guard against unset partition in poison_by_decoder()

[Dave Jiang <dave.jiang@intel.com>]

poison_by_decoder() reads cxlds->part[cxled->part].mode after checking
only that cxled->dpa_res is set. During enumeration __cxl_dpa_reserve()
sets dpa_res but leaves cxled->part at -1 when the range maps no
partition, and the decoder is still added. cxl_get_poison_by_endpoint()
then walks it, indexing part[-1] out of bounds.

Skip decoders with cxled->part < 0, matching cxl_region_attach() which
treats an unset partition as a dead decoder.

Fixes: be5cbd084027 ("cxl: Kill enum cxl_decoder_mode")
Reported-by: sashiko-bot@kernel.org
Closes: https://sashiko.dev/#/patchset/20260708074228.43654-1-icheng@nvidia.com?part=4
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
---
 drivers/cxl/core/region.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 1e211542b6b6..ec0dc4284c3c 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2959,6 +2959,9 @@ static int poison_by_decoder(struct device *dev, void *arg)
 	if (!cxled->dpa_res)
 		return rc;
 
+	if (cxled->part < 0)
+		return rc;
+
 	cxlmd = cxled_to_memdev(cxled);
 	cxlds = cxlmd->cxlds;
 	mode = cxlds->part[cxled->part].mode;
-- 
2.55.0