[PATCH 5/8] cxl/hdm: Fix out of bounds read of the decoder target list

[Guixin Liu <kanie@linux.alibaba.com>]

init_hdm_decoder() copies the HDM Decoder Target List register into
cxld->target_map using the decoder's interleave ways as the element count:

	union {
		u64 value;
		unsigned char target_id[8];
	} target_list;
	...
	target_list.value = (hi << 32) + lo;
	for (i = 0; i < cxld->interleave_ways; i++)
		cxld->target_map[i] = target_list.target_id[i];

The Target List register is 8 bytes wide, i.e. 8 target ports, but
interleave ways comes from the 4-bit Interleave Ways field of the decoder
control register, and eiw_to_ways() maps the valid encodings to 1, 2, 4, 8,
16 (eiw 0-4) and 3, 6, 12 (eiw 8-10). A switch or host bridge decoder found
programmed with 12 or 16 ways therefore reads up to 8 bytes past the
on-stack union.

The region programming path already rejects that configuration in
cxl_port_setup_targets(), 'if (iw > 8 || iw > cxlsd->nr_targets)', but the
enumeration path of a BIOS programmed decoder has no such check.

Reject the decoder instead, consistent with how the neighbouring
eiw_to_ways() and eig_to_granularity() failures are handled: a target list
that cannot describe the interleave is not a configuration the driver can
attach a region to.

Fixes: d17d0540a0db ("cxl/core/hdm: Add CXL standard decoder enumeration to the core")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
 drivers/cxl/core/hdm.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index 0c80b76a5f9b..9d49b48a4456 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -1084,6 +1084,18 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
 		cxld->interleave_ways, cxld->interleave_granularity);
 
 	if (!cxled) {
+		/*
+		 * The Target List register only holds
+		 * ARRAY_SIZE(target_list.target_id) entries, so a switch
+		 * decoder cannot interleave across more ports than that.
+		 */
+		if (cxld->interleave_ways > ARRAY_SIZE(target_list.target_id)) {
+			dev_warn(&port->dev,
+				 "decoder%d.%d: Interleave ways: %d exceeds target list size\n",
+				 port->id, cxld->id, cxld->interleave_ways);
+			return -ENXIO;
+		}
+
 		lo = readl(hdm + CXL_HDM_DECODER0_TL_LOW(which));
 		hi = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(which));
 		target_list.value = (hi << 32) + lo;
-- 
2.43.7