Re: [PATCH v1 2/4] cxl/region: Add region reference in memdev attach

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] cxl: Use-After-Free of attach->cxlr when endpoint unbinds
--

commit 0680840dffb6451e74369681a082d7e4373586f8
Author: Alejandro Lucero <alucerop@amd.com>

cxl/region: Add region reference in memdev attach

Use a new field in cxl_attach_region struct for easily link it with the
region the memdev is attached to. This facilitates device links creation
where such a region is the supplier with non-PF0 physical functions wanting
to use the CXL region being the consumers.

> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index 27e63e6dab7c8..78ca7ebc3e557 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c
> @@ -4132,6 +4132,7 @@ int cxl_memdev_attach_region(struct cxl_memdev *cxlmd)
>  	if (rc)
>  		return rc;
>  
> +	attach->cxlr = cxlr;

[Severity: High]
Could this result in a use-after-free if the endpoint is unbound?

Looking at cxl_memdev_attach_region(), attach is dynamically allocated on the
parent PCI device (cxlds->dev), but the lifetime of cxlr is exclusively tied
to endpoint->dev via the devm action endpoint_unregister_region.

If the CXL endpoint port (endpoint->dev) driver is unbound independently of the
PCI device (e.g., via sysfs or error recovery), the devm action runs and drops
the final reference, freeing cxlr.

However, attach remains alive on the still-bound PCI device, leaving
attach->cxlr pointing to freed memory. A subsequent consumer calling
cxl_get_pf0_memdev() could then access attach->cxlr->dev and trigger a
use-after-free.

Should an additional reference to cxlr be taken here, or the pointer cleared
during endpoint teardown?

>  	attach->hpa_range = (struct range) {
>  		.start = cxlr->params.res->start,
>  		.end = cxlr->params.res->end,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921191239.4249-1-alucerop@amd.com?part=2