Re: [PATCH v2 03/13] cxl/hdm: Add function to restore CXL.mem decode

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] `cxl_trigger_poison_list()` can trigger a kernel panic by dereferencing an ERR_PTR when checking `is_cxl_endpoint(port)`.
--

--- Patch [3]: [PATCH v2 03/13] cxl/hdm: Add function to restore CXL.mem decode ---
commit 3dc5dc9495c42e77bea8b303acf10562a2ca0f7a
Author: Fabio M. De Francesco <fabio.m.de.francesco@linux.intel.com>

cxl/hdm: Add function to restore CXL.mem decode

This commit adds a function to put an endpoint back in HDM decode before
its decoders are committed again. It takes the Global Control value to
enable decode and skips endpoints that decode through DVSEC ranges.

> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> index d55d764895f88..7c898c60f60f6 100644
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c

[ ... ]

> +int cxl_endpoint_enable_hdm_decode(struct cxl_memdev *cxlmd, u32 global_ctrl)
> +{
> +	struct cxl_port *endpoint = cxlmd->endpoint;

[Severity: High]
This is a pre-existing issue, but since we are accessing cxlmd->endpoint
here, can this endpoint be an error pointer that causes a panic elsewhere?

Looking at cxl_trigger_poison_list() in drivers/cxl/core/memdev.c, if a
privileged user writes to the sysfs attribute trigger_poison_list early:

    port = cxlmd->endpoint;
    if (!port || !is_cxl_endpoint(port))
        return -EINVAL;

If the sysfs attribute is accessed before bus enumeration completes, or if
enumeration fails on a device lacking DVSEC capabilities, cxlmd->endpoint
remains set to ERR_PTR(-ENXIO).

The !port check evaluates to false for an ERR_PTR, and the error pointer is
then passed to is_cxl_endpoint(), which blindly dereferences it causing an
invalid memory access and a kernel panic.

Could this be prevented by using IS_ERR_OR_NULL() instead when validating
the port?

> +	struct cxl_hdm *cxlhdm = dev_get_drvdata(&endpoint->dev);
> +	int rc;

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825022628.3651434-1-fabio.m.de.francesco@linux.intel.com?part=3