Re: [PATCH v3 3/3] cxl/features: Clamp Get Feature output size to the remaining buffer

[Richard Cheng <icheng@nvidia.com>]

On Fri, Jun 26, 2026 at 10:52:55AM +0800, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Silent 16-bit offset wrap-around in CXL feature commands allows device state corruption.
> --
> 
> commit 55606972e1fe115ff716307a2dad0a662361b0c3
> Author: Richard Cheng <icheng@nvidia.com>
> 
> cxl/features: Clamp Get Feature output size to the remaining buffer
> 
> cxl_get_feature() reads a feature in a loop but passes a fixed size_out
> as the output capacity every iteration. This commit changes size_out
> to use the remaining per-iter size, preventing a device from overflowing
> feat_out on the last partial iteration.
> 
> > diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c
> > index ed18ccb5e236e..e52371f873006 100644
> > --- a/drivers/cxl/core/features.c
> > +++ b/drivers/cxl/core/features.c
> [ ... ]
> > @@ -237,7 +237,6 @@ size_t cxl_get_feature(struct cxl_mailbox *cxl_mbox, const uuid_t *feat_uuid,
> >  	if (!feat_out || !feat_out_size)
> >  		return 0;
> >  
> > -	size_out = min(feat_out_size, cxl_mbox->payload_size);
> >  	uuid_copy(&pi.uuid, feat_uuid);
> >  	pi.selection = selection;
> >  	do {
> > @@ -250,7 +249,7 @@ size_t cxl_get_feature(struct cxl_mailbox *cxl_mbox, const uuid_t *feat_uuid,
> 
> [Severity: High]
> This is a pre-existing issue, but does pi.offset silently overflow during
> the loop if offset + data_rcvd_size exceeds 65535?
> 
> Looking at cxl_get_feature(), pi.offset is updated right before this 
> struct initialization:
> 
>     pi.offset = cpu_to_le16(offset + data_rcvd_size);
> 
> Here offset is a u16 and data_rcvd_size is a size_t, but pi.offset
> is __le16. If a user requests a large operation through the fwctl
> interface that sums to greater than 65535, the offset will wrap around and
> truncate the value.
> 
> Could this cause the device to read from (or in the case of
> cxl_set_feature(), write to) the wrong offset, silently corrupting hardware
> feature data?
> 
> >  			.opcode = CXL_MBOX_OP_GET_FEATURE,
> >  			.size_in = sizeof(pi),
> >  			.payload_in = &pi,
> > -			.size_out = size_out,
> > +			.size_out = data_to_rd_size,
> >  			.payload_out = feat_out + data_rcvd_size,
> >  			.min_out = data_to_rd_size,
> >  		};
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260626104102.53892-1-icheng@nvidia.com?part=3

This is a different one , I'll include it in another series.

--Richard