Re: [PATCH v4 1/2] cxl/cdat: Fix uninitialized stack use in bandwidth gathering

[Dave Jiang <dave.jiang@intel.com>]

On 8/31/26 2:22 AM, Guixin Liu wrote:
> cxl_endpoint_gather_bandwidth() and cxl_switch_gather_bandwidth() declare
> access_coordinate arrays on the stack and rely on their helpers to fill
> them. The helpers assign only the bandwidth members, and the combine step
> assigns even those only when both inputs are non-zero. The latency members
> are summed from stack residue on every call, and the bandwidth members
> keep that residue into the region access coordinate sysfs attributes when
> the endpoint CDAT reports no bandwidth.
> 
> Zero initialize the arrays. Zero is the value this code already uses for
> "not reported", so an unset member now reads back as unknown rather than as
> a plausible number.
> 
> Found by code inspection. Tested on a QEMU CXL topology with two endpoints
> sharing a switch upstream link and HMAT generic-port coordinates for the
> host bridge, which the calculation requires to run at all: with temporary
> printk at the combine sites, the unpatched kernel summed 0xfefefefe, the
> CONFIG_INIT_STACK_ALL_PATTERN stack filler, into the latency members, while
> the patched kernel reports the CDAT latency values there.
> 
> Fixes: a5ab0de0ebaa ("cxl: Calculate region bandwidth of targets with shared upstream link")
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
> Reviewed-by: Richard Cheng <icheng@nvidia.com>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>

> ---
>  drivers/cxl/core/cdat.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/cxl/core/cdat.c b/drivers/cxl/core/cdat.c
> index 5c9f07262513..df9261ba84e5 100644
> --- a/drivers/cxl/core/cdat.c
> +++ b/drivers/cxl/core/cdat.c
> @@ -633,9 +633,9 @@ static int cxl_endpoint_gather_bandwidth(struct cxl_region *cxlr,
>  	struct cxl_port *endpoint = to_cxl_port(cxled->cxld.dev.parent);
>  	struct cxl_port *parent_port = to_cxl_port(endpoint->dev.parent);
>  	struct cxl_port *gp_port = to_cxl_port(parent_port->dev.parent);
> -	struct access_coordinate pci_coord[ACCESS_COORDINATE_MAX];
> -	struct access_coordinate sw_coord[ACCESS_COORDINATE_MAX];
> -	struct access_coordinate ep_coord[ACCESS_COORDINATE_MAX];
> +	struct access_coordinate pci_coord[ACCESS_COORDINATE_MAX] = { };
> +	struct access_coordinate sw_coord[ACCESS_COORDINATE_MAX] = { };
> +	struct access_coordinate ep_coord[ACCESS_COORDINATE_MAX] = { };
>  	struct cxl_memdev *cxlmd = cxled_to_memdev(cxled);
>  	struct cxl_dev_state *cxlds = cxlmd->cxlds;
>  	struct pci_dev *pdev = to_pci_dev(cxlds->dev);
> @@ -757,7 +757,7 @@ static struct xarray *cxl_switch_gather_bandwidth(struct cxl_region *cxlr,
>  {
>  	struct xarray *res_xa __free(free_perf_xa) =
>  		kzalloc_obj(*res_xa);
> -	struct access_coordinate coords[ACCESS_COORDINATE_MAX];
> +	struct access_coordinate coords[ACCESS_COORDINATE_MAX] = { };
>  	struct cxl_perf_ctx *ctx, *us_ctx;
>  	unsigned long index, us_index;
>  	int dev_count = 0;