Re: [PATCH v3 1/3] cxl/features: Reject Get Feature count larger than the output buffer

[Richard Cheng <icheng@nvidia.com>]

On Fri, Jun 26, 2026 at 10:54:07AM +0800, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [Critical] Missing bounds checks on user-provided input length in `cxlctl_fw_rpc()` and `cxlctl_set_feature()`, leading to out-of-bounds reads and potential ZERO_SIZE_PTR crashes.
> --
> 
> commit 1f7098b182e4cdaf480b19545ca818cbf043bd29
> Author: Richard Cheng <icheng@nvidia.com>
> 
> cxl/features: Reject Get Feature count larger than the output buffer
> 
> cxlctl_get_feature() sizes its output buffer from the user's
> fwctl_rpc.out_len, but the device is told to write count bytes into
> rpc_out->payload. This adds bounds checking against out_size to prevent
> overflowing the allocated buffer.
> 
> > diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c
> > index 85185af46b72d..9c714ee42a411 100644
> > --- a/drivers/cxl/core/features.c
> > +++ b/drivers/cxl/core/features.c
> > @@ -471,6 +471,10 @@ static void *cxlctl_get_feature(struct cxl_features_state *cxlfs,
> >  	if (!count)
> >  		return ERR_PTR(-EINVAL);
> >  
> > +	if (out_size < offsetof(struct fwctl_rpc_cxl_out, payload) ||
> > +	    count > out_size - offsetof(struct fwctl_rpc_cxl_out, payload))
> > +		return ERR_PTR(-EINVAL);
> > +
> 
> [Severity: Critical]
> This is a pre-existing issue, but while we are adding bounds checks for
> the output buffer here, does cxlctl_fw_rpc() also need to validate the
> user-provided in_len?
> 
> If the ioctl is called with an in_len of 0, could dereferencing
> rpc_in->opcode in cxlctl_fw_rpc() lead to a zero-size pointer crash?
> 
> Similarly, in cxlctl_set_feature(), the operation size is calculated without
> verifying in_len:
> 
>     data_size = rpc_in->op_size - sizeof(feat_in->hdr);
> 
> Could a small in_len combined with a large rpc_in->op_size result in an
> out-of-bounds read, copying adjacent kernel heap memory into the hardware
> mailbox? Would validating in_len against op_size in cxlctl_fw_rpc() prevent
> this?
> 
> >  	struct fwctl_rpc_cxl_out *rpc_out __free(kvfree) =
> >  		kvzalloc(out_size, GFP_KERNEL);
> >  	if (!rpc_out)
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260626104102.53892-1-icheng@nvidia.com?part=1

I think this is addressed here.

https://lore.kernel.org/linux-cxl/20260620-cxl-fwctl-oob-v1-1-5758e34d784a@gmail.com/

--Richard