Re: [PATCH v4 2/6] cxl/region: Generalize endpoint position mapping

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free read of device structure in find_pos_and_gran error path.
--

--- Patch [2]: [PATCH v4 2/6] cxl/region: Generalize endpoint position mapping ---
commit 74f53df9f58a0339cb5f29038f2e514904e34cf5
Author: Alison Schofield <alison.schofield@intel.com>

cxl/region: Generalize endpoint position mapping

This commit alters the endpoint position calculation to support
mixed-granularity regions. It weights each decoder's contribution by its
relative granularity instead of assuming a uniform granularity across the
interleave hierarchy.

> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index 3b640c9ba5a08..4f367feaf6c84 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c
[ ... ]
> @@ -1929,9 +1934,10 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range,
>  		return rc;
>  	}
>  	cxlsd = to_cxl_switch_decoder(dev);
> -	*ways = cxlsd->cxld.interleave_ways;
> +	ways = cxlsd->cxld.interleave_ways;
> +	*gran = cxlsd->cxld.interleave_granularity;
>  
> -	for (int i = 0; i < *ways; i++) {
> +	for (int i = 0; i < ways; i++) {
>  		if (cxlsd->target[i] == port->parent_dport) {
>  			*pos = i;
>  			rc = 0;

[Severity: High]
This is a pre-existing issue, but could the error handling path just after
this loop trigger a use-after-free?

Looking at find_pos_and_gran(), if the loop completes without finding a
match, rc remains -ENXIO. Immediately after the loop, put_device(dev) is
called, and then dev_err() formats an error message using cxlsd:

	put_device(dev);

	if (rc)
		dev_err(port->uport_dev,
			"failed to find %s:%s in target list of %s\n",
			dev_name(&port->dev),
			dev_name(port->parent_dport->dport_dev),
			dev_name(&cxlsd->cxld.dev));

Since cxlsd is derived from dev, does calling put_device() before dev_err()
release the structure prematurely and cause a read of freed memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1787255388.git.alison.schofield@intel.com?part=2