[PATCH v3 1/1] cxl/memdev: Hold memdev lock during memdev poison injection/clear

[PATCH v3 1/1] cxl/memdev: Hold memdev lock during memdev poison injection/clear

[Li Ming]

cxl_dpa_to_region() assumes that it is running a context where it is not
racing changes to "cxlmd->dev.driver". Acquire the memdev device lock in
the debugfs entry points to preclude debugfs usage racing cxl_mem driver
detach.

Suggested-by: Dan Williams <djbw@kernel.org>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dan Williams <djbw@kernel.org>
Signed-off-by: Li Ming <ming.li@zohomail.com>
---
This patch originally belonged to the patchset[1], but was not merged
into mainline together with the rest of the patchset. Resend this patch
individually.

[1]: https://lore.kernel.org/linux-cxl/20260314-fix_access_endpoint_without_drv_check-v2-0-4c09edf2e1db@zohomail.com/T/#m9c302a841a3d26aa2eb7217ccdcdc4ae2607740a

Changes in v3:
- Update changelog. (Dan)
- Add review tag from Dan.
Changes in v2:
- Move hoding CXL memdev lock to cxl_debugfs_poison_inject/clear(). (Alison)
---
 drivers/cxl/mem.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/cxl/mem.c b/drivers/cxl/mem.c
index fcffe24dcb42..ab88eaa31d1d 100644
--- a/drivers/cxl/mem.c
+++ b/drivers/cxl/mem.c
@@ -48,6 +48,11 @@ static int cxl_mem_dpa_show(struct seq_file *file, void *data)
 static int cxl_debugfs_poison_inject(void *data, u64 dpa)
 {
 	struct cxl_memdev *cxlmd = data;
+	int rc;
+
+	ACQUIRE(device_intr, devlock)(&cxlmd->dev);
+	if ((rc = ACQUIRE_ERR(device_intr, &devlock)))
+		return rc;
 
 	return cxl_inject_poison(cxlmd, dpa);
 }
@@ -58,6 +63,11 @@ DEFINE_DEBUGFS_ATTRIBUTE(cxl_poison_inject_fops, NULL,
 static int cxl_debugfs_poison_clear(void *data, u64 dpa)
 {
 	struct cxl_memdev *cxlmd = data;
+	int rc;
+
+	ACQUIRE(device_intr, devlock)(&cxlmd->dev);
+	if ((rc = ACQUIRE_ERR(device_intr, &devlock)))
+		return rc;
 
 	return cxl_clear_poison(cxlmd, dpa);
 }
-- 
2.43.0

Re: [PATCH v3 1/1] cxl/memdev: Hold memdev lock during memdev poison injection/clear

[Dave Jiang]

On 4/23/26 4:19 AM, Li Ming wrote:
> cxl_dpa_to_region() assumes that it is running a context where it is not
> racing changes to "cxlmd->dev.driver". Acquire the memdev device lock in
> the debugfs entry points to preclude debugfs usage racing cxl_mem driver
> detach.
> 
> Suggested-by: Dan Williams <djbw@kernel.org>
> Reviewed-by: Dave Jiang <dave.jiang@intel.com>
> Reviewed-by: Alison Schofield <alison.schofield@intel.com>
> Reviewed-by: Dan Williams <djbw@kernel.org>
> Signed-off-by: Li Ming <ming.li@zohomail.com>

Applied to cxl/next
c13052967873

> ---
> This patch originally belonged to the patchset[1], but was not merged
> into mainline together with the rest of the patchset. Resend this patch
> individually.
> 
> [1]: https://lore.kernel.org/linux-cxl/20260314-fix_access_endpoint_without_drv_check-v2-0-4c09edf2e1db@zohomail.com/T/#m9c302a841a3d26aa2eb7217ccdcdc4ae2607740a
> 
> Changes in v3:
> - Update changelog. (Dan)
> - Add review tag from Dan.
> Changes in v2:
> - Move hoding CXL memdev lock to cxl_debugfs_poison_inject/clear(). (Alison)
> ---
>  drivers/cxl/mem.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/drivers/cxl/mem.c b/drivers/cxl/mem.c
> index fcffe24dcb42..ab88eaa31d1d 100644
> --- a/drivers/cxl/mem.c
> +++ b/drivers/cxl/mem.c
> @@ -48,6 +48,11 @@ static int cxl_mem_dpa_show(struct seq_file *file, void *data)
>  static int cxl_debugfs_poison_inject(void *data, u64 dpa)
>  {
>  	struct cxl_memdev *cxlmd = data;
> +	int rc;
> +
> +	ACQUIRE(device_intr, devlock)(&cxlmd->dev);
> +	if ((rc = ACQUIRE_ERR(device_intr, &devlock)))
> +		return rc;
>  
>  	return cxl_inject_poison(cxlmd, dpa);
>  }
> @@ -58,6 +63,11 @@ DEFINE_DEBUGFS_ATTRIBUTE(cxl_poison_inject_fops, NULL,
>  static int cxl_debugfs_poison_clear(void *data, u64 dpa)
>  {
>  	struct cxl_memdev *cxlmd = data;
> +	int rc;
> +
> +	ACQUIRE(device_intr, devlock)(&cxlmd->dev);
> +	if ((rc = ACQUIRE_ERR(device_intr, &devlock)))
> +		return rc;
>  
>  	return cxl_clear_poison(cxlmd, dpa);
>  }