[PATCH 2/3] cxl/ras: Clear software-only TLP log fields after RCH AER copy

[Dave Jiang <dave.jiang@intel.com>]

cxl_rch_get_aer_info() copies the AER capability from MMIO into struct
aer_capability_regs by dword. That struct embeds struct pcie_tlp_log,
whose software-only header_len and flit fields sit past the hardware
registers, so the raw copy fills them with garbage. pcie_print_tlp_log()
then walks dw[] up to header_len (a u8, up to 255) over a 14-entry
array, reading off the stack and leaking it into the error log.

Reset header_len and flit after the copy so only the standard header is
walked.

Fixes: 7e077e6707b3 ("PCI/ERR: Handle TLP Log in Flit mode")
Reported-by: sashiko-bot@kernel.org
Closes: https://sashiko.dev/#/patchset/20260717222706.3540281-1-terry.bowman@amd.com?part=1
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
---
 drivers/cxl/core/ras_rch.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/cxl/core/ras_rch.c b/drivers/cxl/core/ras_rch.c
index 0a8b3b9b6388..a847727686df 100644
--- a/drivers/cxl/core/ras_rch.c
+++ b/drivers/cxl/core/ras_rch.c
@@ -69,6 +69,13 @@ static bool cxl_rch_get_aer_info(void __iomem *aer_base,
 	for (n = 0; n < read_cnt; n++)
 		aer_regs_buf[n] = readl(aer_base + n * sizeof(u32));
 
+	/*
+	 * header_len and flit are software-only metadata in struct
+	 * pcie_tlp_log; Clear to remove garbage register contents.
+	 */
+	aer_regs->header_log.header_len = 0;
+	aer_regs->header_log.flit = false;
+
 	writel(aer_regs->uncor_status, aer_base + PCI_ERR_UNCOR_STATUS);
 	writel(aer_regs->cor_status, aer_base + PCI_ERR_COR_STATUS);
 
-- 
2.55.0