Re: [PATCH v2 2/4] cxl/events: Validate the record count reported by the device

["Cheatham, Benjamin" <benjamin.cheatham@amd.com>]

On 8/31/2026 7:26 PM, Anisa Su wrote:
> cxl_mem_get_records_log() takes the record count straight out of the Get
> Event Records payload and uses it to read from payload->records[].
> An oversized count reads past that buffer. Both
> __cxl_event_trace_record() and cxl_clear_event_record() use the record
> count to iterate oer payload->records[].
		   ^ over> 
> Bound the count by mbox_cmd.size_out which is already sanitized by
>  __cxl_pci_mbox_send_cmd(). Report a bad record count as an error rather than a
> drained log, so a device repeating the bad count does not keep the event
> thread re-reading it.
> 
> Fixes: 6ebe28f9ec72 ("cxl/mem: Read, trace, and clear events on driver load")
> Signed-off-by: Anisa Su <anisa.su@samsung.com>
> ---
>  drivers/cxl/core/mbox.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
> index 2b71a8e1f35f..02b8c33a74b6 100644
> --- a/drivers/cxl/core/mbox.c
> +++ b/drivers/cxl/core/mbox.c
> @@ -1110,6 +1110,14 @@ static int cxl_mem_get_records_log(struct cxl_memdev_state *mds,
>  		nr_rec = le16_to_cpu(payload->record_count);
>  		if (!nr_rec)
>  			break;
> +
> +		if (struct_size(payload, records, nr_rec) > mbox_cmd.size_out) {
> +			dev_err_ratelimited(dev,
> +				"Event log '%d': record count %u mismatch in %zu byte payload",

The units should probably match here, so either the record count should be the size in bytes or the
size_out should be the number of records expected.

With that:
Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>

> +				type, nr_rec, mbox_cmd.size_out);
> +			rc = -EIO;
> +			break;
> +		}
>  		*got_records = true;
>  
>  		for (i = 0; i < nr_rec; i++)