* [PATCH 1/2] cxl/hdm: Fix && vs || bug
@ 2023-10-31 9:53 Dan Carpenter
2023-10-31 9:54 ` [PATCH 2/2] cxl/hdm: add unlock on error path Dan Carpenter
2023-10-31 11:02 ` [PATCH 1/2] cxl/hdm: Fix && vs || bug Robert Richter
0 siblings, 2 replies; 6+ messages in thread
From: Dan Carpenter @ 2023-10-31 9:53 UTC (permalink / raw)
To: Robert Richter
Cc: Davidlohr Bueso, Jonathan Cameron, Dave Jiang, Alison Schofield,
Vishal Verma, Ira Weiny, Dan Williams, Terry Bowman, linux-cxl,
linux-kernel, kernel-janitors
If "info" is NULL then this code will crash. || was intended instead of
&&.
Fixes: 8ce520fdea24 ("cxl/hdm: Use stored Component Register mappings to map HDM decoder capability")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/cxl/core/hdm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index bc8ad4a8afca..af17da8230d5 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -146,7 +146,7 @@ struct cxl_hdm *devm_cxl_setup_hdm(struct cxl_port *port,
/* Memory devices can configure device HDM using DVSEC range regs. */
if (reg_map->resource == CXL_RESOURCE_NONE) {
- if (!info && !info->mem_enabled) {
+ if (!info || !info->mem_enabled) {
dev_err(dev, "No component registers mapped\n");
return ERR_PTR(-ENXIO);
}
--
2.42.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/2] cxl/hdm: add unlock on error path 2023-10-31 9:53 [PATCH 1/2] cxl/hdm: Fix && vs || bug Dan Carpenter @ 2023-10-31 9:54 ` Dan Carpenter 2023-10-31 21:17 ` Dan Williams 2023-10-31 11:02 ` [PATCH 1/2] cxl/hdm: Fix && vs || bug Robert Richter 1 sibling, 1 reply; 6+ messages in thread From: Dan Carpenter @ 2023-10-31 9:54 UTC (permalink / raw) To: Dan Williams Cc: Davidlohr Bueso, Jonathan Cameron, Dave Jiang, Alison Schofield, Vishal Verma, Ira Weiny, Terry Bowman, Robert Richter, linux-cxl, kernel-janitors This error path needs to call up_read(&cxl_dpa_rwsem). Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- drivers/cxl/core/hdm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c index af17da8230d5..0eb580245276 100644 --- a/drivers/cxl/core/hdm.c +++ b/drivers/cxl/core/hdm.c @@ -684,6 +684,7 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld) if (rc) { dev_dbg(&port->dev, "%s: target configuration error\n", dev_name(&cxld->dev)); + up_read(&cxl_dpa_rwsem); goto err; } -- 2.42.0 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* RE: [PATCH 2/2] cxl/hdm: add unlock on error path 2023-10-31 9:54 ` [PATCH 2/2] cxl/hdm: add unlock on error path Dan Carpenter @ 2023-10-31 21:17 ` Dan Williams 2023-10-31 21:47 ` Dave Jiang 2023-10-31 22:04 ` Ira Weiny 0 siblings, 2 replies; 6+ messages in thread From: Dan Williams @ 2023-10-31 21:17 UTC (permalink / raw) To: Dan Carpenter, Dan Williams Cc: Davidlohr Bueso, Jonathan Cameron, Dave Jiang, Alison Schofield, Vishal Verma, Ira Weiny, Terry Bowman, Robert Richter, linux-cxl, kernel-janitors Dan Carpenter wrote: > This error path needs to call up_read(&cxl_dpa_rwsem). This looks correct for what it is, but that error path is a "should never happen" situation. It would be better to just eliminate that possibility altogether... -- >8 -- Subject: cxl/hdm: Remove broken error path From: Dan Williams <dan.j.williams@intel.com> Dan reports that cxl_decoder_commit() potentially leaks a hold of cxl_dpa_rwsem. The potential error case is a "should" not happen scenario, turn it into a "can not" happen scenario by adding the error check to cxl_port_setup_targets() where other setting validation occurs. Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: http://lore.kernel.org/r/63295673-5d63-4919-b851-3b06d48734c0@moroto.mountain Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware") Signed-off-by: Dan Williams <dan.j.williams@intel.com> --- drivers/cxl/core/hdm.c | 19 ++----------------- drivers/cxl/core/region.c | 8 ++++++++ 2 files changed, 10 insertions(+), 17 deletions(-) diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c index af17da8230d5..1cc9be85ba4c 100644 --- a/drivers/cxl/core/hdm.c +++ b/drivers/cxl/core/hdm.c @@ -565,17 +565,11 @@ static void cxld_set_type(struct cxl_decoder *cxld, u32 *ctrl) CXL_HDM_DECODER0_CTRL_HOSTONLY); } -static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt) +static void cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt) { struct cxl_dport **t = &cxlsd->target[0]; int ways = cxlsd->cxld.interleave_ways; - if (dev_WARN_ONCE(&cxlsd->cxld.dev, - ways > 8 || ways > cxlsd->nr_targets, - "ways: %d overflows targets: %d\n", ways, - cxlsd->nr_targets)) - return -ENXIO; - *tgt = FIELD_PREP(GENMASK(7, 0), t[0]->port_id); if (ways > 1) *tgt |= FIELD_PREP(GENMASK(15, 8), t[1]->port_id); @@ -591,8 +585,6 @@ static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt) *tgt |= FIELD_PREP(GENMASK_ULL(55, 48), t[6]->port_id); if (ways > 7) *tgt |= FIELD_PREP(GENMASK_ULL(63, 56), t[7]->port_id); - - return 0; } /* @@ -680,13 +672,7 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld) void __iomem *tl_lo = hdm + CXL_HDM_DECODER0_TL_LOW(id); u64 targets; - rc = cxlsd_set_targets(cxlsd, &targets); - if (rc) { - dev_dbg(&port->dev, "%s: target configuration error\n", - dev_name(&cxld->dev)); - goto err; - } - + cxlsd_set_targets(cxlsd, &targets); writel(upper_32_bits(targets), tl_hi); writel(lower_32_bits(targets), tl_lo); } else { @@ -704,7 +690,6 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld) port->commit_end++; rc = cxld_await_commit(hdm, cxld->id); -err: if (rc) { dev_dbg(&port->dev, "%s: error %d committing decoder\n", dev_name(&cxld->dev), rc); diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index 8d3580a0db53..56e575c79bb4 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -1196,6 +1196,14 @@ static int cxl_port_setup_targets(struct cxl_port *port, return rc; } + if (iw > 8 || iw > cxlsd->nr_targets) { + dev_dbg(&cxlr->dev, + "%s:%s:%s: ways: %d overflows targets: %d\n", + dev_name(port->uport_dev), dev_name(&port->dev), + dev_name(&cxld->dev), iw, cxlsd->nr_targets); + return -ENXIO; + } + if (test_bit(CXL_REGION_F_AUTO, &cxlr->flags)) { if (cxld->interleave_ways != iw || cxld->interleave_granularity != ig || ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] cxl/hdm: add unlock on error path 2023-10-31 21:17 ` Dan Williams @ 2023-10-31 21:47 ` Dave Jiang 2023-10-31 22:04 ` Ira Weiny 1 sibling, 0 replies; 6+ messages in thread From: Dave Jiang @ 2023-10-31 21:47 UTC (permalink / raw) To: Dan Williams, Dan Carpenter Cc: Davidlohr Bueso, Jonathan Cameron, Alison Schofield, Vishal Verma, Ira Weiny, Terry Bowman, Robert Richter, linux-cxl, kernel-janitors On 10/31/23 14:17, Dan Williams wrote: > Dan Carpenter wrote: >> This error path needs to call up_read(&cxl_dpa_rwsem). > > This looks correct for what it is, but that error path is a "should > never happen" situation. It would be better to just eliminate that > possibility altogether... > > -- >8 -- > Subject: cxl/hdm: Remove broken error path > > From: Dan Williams <dan.j.williams@intel.com> > > Dan reports that cxl_decoder_commit() potentially leaks a hold of > cxl_dpa_rwsem. The potential error case is a "should" not happen > scenario, turn it into a "can not" happen scenario by adding the error > check to cxl_port_setup_targets() where other setting validation occurs. > > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Closes: http://lore.kernel.org/r/63295673-5d63-4919-b851-3b06d48734c0@moroto.mountain > Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware") > Signed-off-by: Dan Williams <dan.j.williams@intel.com> LGTM Reviewed-by: Dave Jiang <dave.jiang@intel.com> > --- > drivers/cxl/core/hdm.c | 19 ++----------------- > drivers/cxl/core/region.c | 8 ++++++++ > 2 files changed, 10 insertions(+), 17 deletions(-) > > diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c > index af17da8230d5..1cc9be85ba4c 100644 > --- a/drivers/cxl/core/hdm.c > +++ b/drivers/cxl/core/hdm.c > @@ -565,17 +565,11 @@ static void cxld_set_type(struct cxl_decoder *cxld, u32 *ctrl) > CXL_HDM_DECODER0_CTRL_HOSTONLY); > } > > -static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt) > +static void cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt) > { > struct cxl_dport **t = &cxlsd->target[0]; > int ways = cxlsd->cxld.interleave_ways; > > - if (dev_WARN_ONCE(&cxlsd->cxld.dev, > - ways > 8 || ways > cxlsd->nr_targets, > - "ways: %d overflows targets: %d\n", ways, > - cxlsd->nr_targets)) > - return -ENXIO; > - > *tgt = FIELD_PREP(GENMASK(7, 0), t[0]->port_id); > if (ways > 1) > *tgt |= FIELD_PREP(GENMASK(15, 8), t[1]->port_id); > @@ -591,8 +585,6 @@ static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt) > *tgt |= FIELD_PREP(GENMASK_ULL(55, 48), t[6]->port_id); > if (ways > 7) > *tgt |= FIELD_PREP(GENMASK_ULL(63, 56), t[7]->port_id); > - > - return 0; > } > > /* > @@ -680,13 +672,7 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld) > void __iomem *tl_lo = hdm + CXL_HDM_DECODER0_TL_LOW(id); > u64 targets; > > - rc = cxlsd_set_targets(cxlsd, &targets); > - if (rc) { > - dev_dbg(&port->dev, "%s: target configuration error\n", > - dev_name(&cxld->dev)); > - goto err; > - } > - > + cxlsd_set_targets(cxlsd, &targets); > writel(upper_32_bits(targets), tl_hi); > writel(lower_32_bits(targets), tl_lo); > } else { > @@ -704,7 +690,6 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld) > > port->commit_end++; > rc = cxld_await_commit(hdm, cxld->id); > -err: > if (rc) { > dev_dbg(&port->dev, "%s: error %d committing decoder\n", > dev_name(&cxld->dev), rc); > diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c > index 8d3580a0db53..56e575c79bb4 100644 > --- a/drivers/cxl/core/region.c > +++ b/drivers/cxl/core/region.c > @@ -1196,6 +1196,14 @@ static int cxl_port_setup_targets(struct cxl_port *port, > return rc; > } > > + if (iw > 8 || iw > cxlsd->nr_targets) { > + dev_dbg(&cxlr->dev, > + "%s:%s:%s: ways: %d overflows targets: %d\n", > + dev_name(port->uport_dev), dev_name(&port->dev), > + dev_name(&cxld->dev), iw, cxlsd->nr_targets); > + return -ENXIO; > + } > + > if (test_bit(CXL_REGION_F_AUTO, &cxlr->flags)) { > if (cxld->interleave_ways != iw || > cxld->interleave_granularity != ig || ^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: [PATCH 2/2] cxl/hdm: add unlock on error path 2023-10-31 21:17 ` Dan Williams 2023-10-31 21:47 ` Dave Jiang @ 2023-10-31 22:04 ` Ira Weiny 1 sibling, 0 replies; 6+ messages in thread From: Ira Weiny @ 2023-10-31 22:04 UTC (permalink / raw) To: Dan Williams, Dan Carpenter Cc: Davidlohr Bueso, Jonathan Cameron, Dave Jiang, Alison Schofield, Vishal Verma, Ira Weiny, Terry Bowman, Robert Richter, linux-cxl, kernel-janitors Dan Williams wrote: > Dan Carpenter wrote: > > This error path needs to call up_read(&cxl_dpa_rwsem). > > This looks correct for what it is, but that error path is a "should > never happen" situation. It would be better to just eliminate that > possibility altogether... > > -- >8 -- > Subject: cxl/hdm: Remove broken error path > > From: Dan Williams <dan.j.williams@intel.com> > > Dan reports that cxl_decoder_commit() potentially leaks a hold of > cxl_dpa_rwsem. The potential error case is a "should" not happen > scenario, turn it into a "can not" happen scenario by adding the error > check to cxl_port_setup_targets() where other setting validation occurs. > > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Closes: http://lore.kernel.org/r/63295673-5d63-4919-b851-3b06d48734c0@moroto.mountain > Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware") Reviewed-by: Ira Weiny <ira.weiny@intel.com> ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] cxl/hdm: Fix && vs || bug 2023-10-31 9:53 [PATCH 1/2] cxl/hdm: Fix && vs || bug Dan Carpenter 2023-10-31 9:54 ` [PATCH 2/2] cxl/hdm: add unlock on error path Dan Carpenter @ 2023-10-31 11:02 ` Robert Richter 1 sibling, 0 replies; 6+ messages in thread From: Robert Richter @ 2023-10-31 11:02 UTC (permalink / raw) To: Dan Carpenter Cc: Davidlohr Bueso, Jonathan Cameron, Dave Jiang, Alison Schofield, Vishal Verma, Ira Weiny, Dan Williams, Terry Bowman, linux-cxl, linux-kernel, kernel-janitors On 31.10.23 12:53:52, Dan Carpenter wrote: > If "info" is NULL then this code will crash. || was intended instead of > &&. > > Fixes: 8ce520fdea24 ("cxl/hdm: Use stored Component Register mappings to map HDM decoder capability") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > drivers/cxl/core/hdm.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c > index bc8ad4a8afca..af17da8230d5 100644 > --- a/drivers/cxl/core/hdm.c > +++ b/drivers/cxl/core/hdm.c > @@ -146,7 +146,7 @@ struct cxl_hdm *devm_cxl_setup_hdm(struct cxl_port *port, > > /* Memory devices can configure device HDM using DVSEC range regs. */ > if (reg_map->resource == CXL_RESOURCE_NONE) { > - if (!info && !info->mem_enabled) { > + if (!info || !info->mem_enabled) { Right, there was a bug. Reviewed-by: Robert Richter <rrichter@amd.com> > dev_err(dev, "No component registers mapped\n"); > return ERR_PTR(-ENXIO); > } > -- > 2.42.0 > ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-10-31 22:04 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2023-10-31 9:53 [PATCH 1/2] cxl/hdm: Fix && vs || bug Dan Carpenter 2023-10-31 9:54 ` [PATCH 2/2] cxl/hdm: add unlock on error path Dan Carpenter 2023-10-31 21:17 ` Dan Williams 2023-10-31 21:47 ` Dave Jiang 2023-10-31 22:04 ` Ira Weiny 2023-10-31 11:02 ` [PATCH 1/2] cxl/hdm: Fix && vs || bug Robert Richter
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox