From: Richard Cheng <icheng@nvidia.com>
To: dave@stgolabs.net, jic23@kernel.org, dave.jiang@intel.com,
alison.schofield@intel.com, vishal.l.verma@intel.com
Cc: iweiny@kernel.org, ming.li@zohomail.com, gourry@gourry.net,
rrichter@amd.com, linux-cxl@vger.kernel.org,
linux-kernel@vger.kernel.org, kees@kernel.org,
newtonl@nvidia.com, kristinc@nvidia.com, kaihengf@nvidia.com,
kobak@nvidia.com, Richard Cheng <icheng@nvidia.com>
Subject: [PATCH v4 6/6] cxl/region: Reject poison scan for decoder without a partition
Date: Wed, 12 Aug 2026 19:21:07 +0800 [thread overview]
Message-ID: <20260812112107.56181-7-icheng@nvidia.com> (raw)
In-Reply-To: <20260812112107.56181-1-icheng@nvidia.com>
__cxl_dpa_reserve() may leave cxled->part at -1 when a decoder's DPA
range doesn't map to any reported partition, while still keeping
dpa_res. poison_by_decoder() then indexes cxlds->part[-1], causing an
out-of-bounds read when poison collection is triggered.
Return -ENODEV before accessing the partition array when no partition was
assigned.
Fixes: be5cbd084027 ("cxl: Kill enum cxl_decoder_mode")
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
drivers/cxl/core/region.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index b7dc5d4988da..afe3fb57b7fe 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2954,6 +2954,8 @@ static int poison_by_decoder(struct device *dev, void *arg)
cxled = to_cxl_endpoint_decoder(dev);
if (!cxled->dpa_res)
return rc;
+ if (cxled->part < 0)
+ return -ENODEV;
cxlmd = cxled_to_memdev(cxled);
cxlds = cxlmd->cxlds;
--
2.43.0
next prev parent reply other threads:[~2026-08-12 11:22 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-12 11:21 [PATCH v4 0/6] cxl: Sashiko bug fixes Richard Cheng
2026-08-12 11:21 ` [PATCH v4 1/6] cxl/features: Reject feature offset that overflows 16-bit field Richard Cheng
2026-08-12 11:52 ` sashiko-bot
2026-08-12 11:21 ` [PATCH v4 2/6] cxl/region: Scan all partitions for unmapped poison Richard Cheng
2026-08-12 11:21 ` [PATCH v4 3/6] cxl/region: Don't leak tolerated RAM -EFAULT from unmapped poison scan Richard Cheng
2026-08-12 12:08 ` sashiko-bot
2026-08-12 11:21 ` [PATCH v4 4/6] cxl/region: Start unmapped poison scan at the committed decoder boundary Richard Cheng
2026-08-12 11:21 ` [PATCH v4 5/6] cxl/memdev: Don't overwrite the error from an earlier partition poison query Richard Cheng
2026-08-12 11:21 ` Richard Cheng [this message]
2026-08-12 12:41 ` [PATCH v4 6/6] cxl/region: Reject poison scan for decoder without a partition sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260812112107.56181-7-icheng@nvidia.com \
--to=icheng@nvidia.com \
--cc=alison.schofield@intel.com \
--cc=dave.jiang@intel.com \
--cc=dave@stgolabs.net \
--cc=gourry@gourry.net \
--cc=iweiny@kernel.org \
--cc=jic23@kernel.org \
--cc=kaihengf@nvidia.com \
--cc=kees@kernel.org \
--cc=kobak@nvidia.com \
--cc=kristinc@nvidia.com \
--cc=linux-cxl@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ming.li@zohomail.com \
--cc=newtonl@nvidia.com \
--cc=rrichter@amd.com \
--cc=vishal.l.verma@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).