[PATCH] cxl/acpi: Restore HBIW check before dereferencing platform_data

[PATCH] cxl/acpi: Restore HBIW check before dereferencing platform_data

[Alison Schofield]

Commit 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available
for testing") split xormap handling code to create a reusable helper
function but inadvertently dropped the check of HBIW values before
dereferencing cxlrd->platform_data. When HBIW is 1 or 3, no xormaps
are needed and platform_data may be NULL, leading to a potential NULL
pointer dereference.

Affects platform configs using XOR Arithmetic with HBIWs of 1 or 3,
when performing DPA->HPA address translation for CXL events. Those
events would be any of poison ops, general media, or dram.

Restore the early return check for HBIW values of 1 and 3 before
dereferencing platform_data.

Fixes: 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available for testing")
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
---

This bug was introduced in 6.19-rc1 and found while rebasing this
work: cxl/region: Translate DPA->HPA in unaligned MOD3 regions.
Adding coverage for this to cxl-test suite is on my todo list.

 drivers/cxl/acpi.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
index 77ac940e3013..49bba2b9a3c4 100644
--- a/drivers/cxl/acpi.c
+++ b/drivers/cxl/acpi.c
@@ -75,9 +75,16 @@ EXPORT_SYMBOL_FOR_MODULES(cxl_do_xormap_calc, "cxl_translate");
 
 static u64 cxl_apply_xor_maps(struct cxl_root_decoder *cxlrd, u64 addr)
 {
-	struct cxl_cxims_data *cximsd = cxlrd->platform_data;
+	int hbiw = cxlrd->cxlsd.nr_targets;
+	struct cxl_cxims_data *cximsd;
 
-	return cxl_do_xormap_calc(cximsd, addr, cxlrd->cxlsd.nr_targets);
+	/* No xormaps for host bridge interleave ways of 1 or 3 */
+	if (hbiw == 1 || hbiw == 3)
+		return addr;
+
+	cximsd = cxlrd->platform_data;
+
+	return cxl_do_xormap_calc(cximsd, addr, hbiw);
 }
 
 struct cxl_cxims_context {

base-commit: 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb
-- 
2.37.3

Re: [PATCH] cxl/acpi: Restore HBIW check before dereferencing platform_data

[Dave Jiang]

On 1/9/26 12:49 PM, Alison Schofield wrote:
> Commit 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available
> for testing") split xormap handling code to create a reusable helper
> function but inadvertently dropped the check of HBIW values before
> dereferencing cxlrd->platform_data. When HBIW is 1 or 3, no xormaps
> are needed and platform_data may be NULL, leading to a potential NULL
> pointer dereference.
> 
> Affects platform configs using XOR Arithmetic with HBIWs of 1 or 3,
> when performing DPA->HPA address translation for CXL events. Those
> events would be any of poison ops, general media, or dram.
> 
> Restore the early return check for HBIW values of 1 and 3 before
> dereferencing platform_data.
> 
> Fixes: 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available for testing")
> Signed-off-by: Alison Schofield <alison.schofield@intel.com>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>


> ---
> 
> This bug was introduced in 6.19-rc1 and found while rebasing this
> work: cxl/region: Translate DPA->HPA in unaligned MOD3 regions.
> Adding coverage for this to cxl-test suite is on my todo list.
> 
>  drivers/cxl/acpi.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
> index 77ac940e3013..49bba2b9a3c4 100644
> --- a/drivers/cxl/acpi.c
> +++ b/drivers/cxl/acpi.c
> @@ -75,9 +75,16 @@ EXPORT_SYMBOL_FOR_MODULES(cxl_do_xormap_calc, "cxl_translate");
>  
>  static u64 cxl_apply_xor_maps(struct cxl_root_decoder *cxlrd, u64 addr)
>  {
> -	struct cxl_cxims_data *cximsd = cxlrd->platform_data;
> +	int hbiw = cxlrd->cxlsd.nr_targets;
> +	struct cxl_cxims_data *cximsd;
>  
> -	return cxl_do_xormap_calc(cximsd, addr, cxlrd->cxlsd.nr_targets);
> +	/* No xormaps for host bridge interleave ways of 1 or 3 */
> +	if (hbiw == 1 || hbiw == 3)
> +		return addr;
> +
> +	cximsd = cxlrd->platform_data;
> +
> +	return cxl_do_xormap_calc(cximsd, addr, hbiw);
>  }
>  
>  struct cxl_cxims_context {
> 
> base-commit: 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb

Re: [PATCH] cxl/acpi: Restore HBIW check before dereferencing platform_data

[Dave Jiang]

On 1/9/26 12:49 PM, Alison Schofield wrote:
> Commit 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available
> for testing") split xormap handling code to create a reusable helper
> function but inadvertently dropped the check of HBIW values before
> dereferencing cxlrd->platform_data. When HBIW is 1 or 3, no xormaps
> are needed and platform_data may be NULL, leading to a potential NULL
> pointer dereference.
> 
> Affects platform configs using XOR Arithmetic with HBIWs of 1 or 3,
> when performing DPA->HPA address translation for CXL events. Those
> events would be any of poison ops, general media, or dram.
> 
> Restore the early return check for HBIW values of 1 and 3 before
> dereferencing platform_data.
> 
> Fixes: 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available for testing")
> Signed-off-by: Alison Schofield <alison.schofield@intel.com>

Applied to cxl/fixes
49d106347913201b6bc6d810c964b90781db8343

Changes small enough and looks reasonable. Would like to get the fixes PR sent in time for rc6 next week.

> ---
> 
> This bug was introduced in 6.19-rc1 and found while rebasing this
> work: cxl/region: Translate DPA->HPA in unaligned MOD3 regions.
> Adding coverage for this to cxl-test suite is on my todo list.
> 
>  drivers/cxl/acpi.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
> index 77ac940e3013..49bba2b9a3c4 100644
> --- a/drivers/cxl/acpi.c
> +++ b/drivers/cxl/acpi.c
> @@ -75,9 +75,16 @@ EXPORT_SYMBOL_FOR_MODULES(cxl_do_xormap_calc, "cxl_translate");
>  
>  static u64 cxl_apply_xor_maps(struct cxl_root_decoder *cxlrd, u64 addr)
>  {
> -	struct cxl_cxims_data *cximsd = cxlrd->platform_data;
> +	int hbiw = cxlrd->cxlsd.nr_targets;
> +	struct cxl_cxims_data *cximsd;
>  
> -	return cxl_do_xormap_calc(cximsd, addr, cxlrd->cxlsd.nr_targets);
> +	/* No xormaps for host bridge interleave ways of 1 or 3 */
> +	if (hbiw == 1 || hbiw == 3)
> +		return addr;
> +
> +	cximsd = cxlrd->platform_data;
> +
> +	return cxl_do_xormap_calc(cximsd, addr, hbiw);
>  }
>  
>  struct cxl_cxims_context {
> 
> base-commit: 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb