Linux CXL
 help / color / mirror / Atom feed
From: Guixin Liu <kanie@linux.alibaba.com>
To: Davidlohr Bueso <dave@stgolabs.net>,
	Jonathan Cameron <jic23@kernel.org>,
	Dave Jiang <dave.jiang@intel.com>,
	Alison Schofield <alison.schofield@intel.com>,
	Vishal Verma <vishal.l.verma@intel.com>,
	Dan Williams <djbw@kernel.org>, Ira Weiny <iweiny@kernel.org>,
	Li Ming <ming.li@zohomail.com>, Robert Richter <rrichter@amd.com>
Cc: linux-cxl@vger.kernel.org, xlpang@linux.alibaba.com,
	oliver.yang@linux.alibaba.com
Subject: [PATCH 4/8] cxl/pci: Fix NULL pointer dereference in reset detection
Date: Tue, 11 Aug 2026 19:36:04 +0800	[thread overview]
Message-ID: <20260811113608.2815625-5-kanie@linux.alibaba.com> (raw)
In-Reply-To: <20260811113608.2815625-1-kanie@linux.alibaba.com>

__cxl_endpoint_decoder_reset_detected() reads the HDM decoder control
register without checking that the endpoint has any:

	cxlhdm = dev_get_drvdata(&port->dev);
	hdm = cxlhdm->regs.hdm_decoder;
	ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(cxld->id));

For a device that has no component registers and describes its HDM ranges
through the CXL DVSEC range registers instead, devm_cxl_setup_hdm() returns
early with cxlhdm->regs.hdm_decoder left NULL and the decoder count taken
from the DVSEC ranges. Those emulated decoders are published with
CXL_DECODER_F_ENABLE set by cxl_setup_hdm_decoder_from_dvsec(), so
cxl_reset_done() walking the endpoint's decoders after an FLR or SBR
reaches the readl() with a NULL base and oopses.

Bail out when there are no HDM decoder registers, mirroring the existing
!hdm test in should_emulate_decoders(). Without those registers there is no
Committed bit to sample, so report "no reset detected" rather than
dereferencing NULL.

Fixes: 934edcd436dc ("cxl: Add post-reset warning if reset results in loss of previously committed HDM decoders")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
 drivers/cxl/core/pci.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index e4338fd7e01b..2515ef4282f2 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -684,6 +684,14 @@ static int __cxl_endpoint_decoder_reset_detected(struct device *dev, void *data)
 
 	cxlhdm = dev_get_drvdata(&port->dev);
 	hdm = cxlhdm->regs.hdm_decoder;
+
+	/*
+	 * Devices that describe their HDM ranges with the DVSEC range
+	 * registers have no HDM decoder registers to consult.
+	 */
+	if (!hdm)
+		return 0;
+
 	ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(cxld->id));
 
 	return !FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMITTED, ctrl);
-- 
2.43.7


  parent reply	other threads:[~2026-08-11 11:36 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-11 11:36 [PATCH 0/8] cxl: Assorted fixes Guixin Liu
2026-08-11 11:36 ` [PATCH 1/8] cxl/features: Validate the fwctl RPC input length Guixin Liu
2026-08-11 11:36 ` [PATCH 2/8] cxl/features: Bound the Get Feature output by the user output buffer Guixin Liu
2026-08-11 11:36 ` [PATCH 3/8] cxl/core: Fix dport use-after-free via the einj_inject debugfs file Guixin Liu
2026-08-11 16:03   ` Li Ming
2026-08-12  1:58     ` Guixin Liu
2026-08-11 11:36 ` Guixin Liu [this message]
2026-08-11 11:36 ` [PATCH 5/8] cxl/hdm: Fix out of bounds read of the decoder target list Guixin Liu
2026-08-11 11:36 ` [PATCH 6/8] cxl/cdat: Fix uninitialized stack use in endpoint bandwidth gathering Guixin Liu
2026-08-11 11:36 ` [PATCH 7/8] cxl/mce: Validate the memdev and endpoint before use Guixin Liu
2026-08-11 11:36 ` [PATCH 8/8] cxl/region: Unregister the pmem region bridge on setup failure Guixin Liu
2026-08-11 19:57 ` [PATCH 0/8] cxl: Assorted fixes Alison Schofield
2026-08-12  2:10   ` Guixin Liu
2026-08-12  6:29     ` Richard Cheng
2026-08-12  6:37       ` Guixin Liu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260811113608.2815625-5-kanie@linux.alibaba.com \
    --to=kanie@linux.alibaba.com \
    --cc=alison.schofield@intel.com \
    --cc=dave.jiang@intel.com \
    --cc=dave@stgolabs.net \
    --cc=djbw@kernel.org \
    --cc=iweiny@kernel.org \
    --cc=jic23@kernel.org \
    --cc=linux-cxl@vger.kernel.org \
    --cc=ming.li@zohomail.com \
    --cc=oliver.yang@linux.alibaba.com \
    --cc=rrichter@amd.com \
    --cc=vishal.l.verma@intel.com \
    --cc=xlpang@linux.alibaba.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox