Re: [PATCH v20 8/9] PCI/CXL: Mask/Unmask CXL protocol errors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Devres memory and action leak on CXL endpoint port unbind/rebind for RCH topologies.
--

commit 6742f1a341d88bb57310da7468fadf1a3f3b4556
Author: Terry Bowman <terry.bowman@amd.com>

PCI/CXL: Mask/Unmask CXL protocol errors

This commit introduces helpers to mask and unmask CXL protocol errors. It
unmasks internal errors in cxl_dport_map_ras() and devm_cxl_port_ras_setup()
after the RAS register block is successfully mapped, and adds a devm action
to restore the mask on teardown.

> diff --git a/drivers/cxl/core/ras.c b/drivers/cxl/core/ras.c
> index fac37b6fd882f..f1e05d240059b 100644
> --- a/drivers/cxl/core/ras.c
> +++ b/drivers/cxl/core/ras.c

[ ... ]

> @@ -124,16 +124,64 @@ static void cxl_cper_prot_err_work_fn(struct work_struct *work)
>  }
>  static DECLARE_WORK(cxl_cper_prot_err_work, cxl_cper_prot_err_work_fn);

[ ... ]

>  static void cxl_dport_map_ras(struct cxl_dport *dport)
>  {
>  	struct cxl_register_map *map = &dport->reg_map;
>  	struct device *dev = dport->dport_dev;
>  
> -	if (!map->component_map.ras.valid)
> +	if (!map->component_map.ras.valid) {
>  		dev_dbg(dev, "RAS registers not found\n");
> -	else if (cxl_map_component_regs(map, &dport->regs.component,
> -					BIT(CXL_CM_CAP_CAP_ID_RAS)))
> +		return;
> +	}
> +
> +	if (cxl_map_component_regs(map, &dport->regs.component,
> +				   BIT(CXL_CM_CAP_CAP_ID_RAS))) {
>  		dev_dbg(dev, "Failed to map RAS capability.\n");
> +		return;
> +	}
> +
> +	if (!dev_is_pci(dev))
> +		return;
> +
> +	cxl_unmask_proto_interrupts(dev);
> +	if (devm_add_action_or_reset(dport_to_host(dport),
> +				     cxl_mask_proto_irqs, dev)) {

[Severity: High]
Does this devres action cause an unbounded memory and action leak when a CXL
endpoint port is unbound and rebound in RCH topologies?

In cxl_endpoint_port_probe() in drivers/cxl/port.c, when dport->rch is true,
it calls devm_cxl_dport_rch_ras_setup(dport). This executes repeatedly across
unbind/bind cycles of the endpoint port.

That setup path eventually calls cxl_dport_map_ras(dport), which registers
the cxl_mask_proto_irqs action on the device returned by
dport_to_host(dport).

For RCH topologies, dport_to_host(dport) evaluates to the parent root port's
host device (the ACPI host bridge), not the endpoint port being probed.

Because the action is tied to the parent host device instead of the endpoint
port, unbinding and rebinding the endpoint port does not free the devres
action. This leaves a leaked action on the parent host device each time the
endpoint port is probed.

> +		dev_warn(dev, "failed to defer CXL proto-irq mask; CXL protocol error reporting disabled\n");
> +		dport->regs.component.ras = NULL;
> +	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902133933.2992457-1-terry.bowman@amd.com?part=8