Re: [PATCH v4 2/6] cxl/region: Generalize endpoint position mapping

[Alison Schofield <alison.schofield@intel.com>]

On Thu, Aug 20, 2026 at 11:43:08PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Use-After-Free read of device structure in find_pos_and_gran error path.
> --

The fix for this issue is in the 7.3 CXL Pull Request.
I expect the next version of this patchset will be based on 7.3-rc1 so
this complaint will go away.

https://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl.git/commit/?h=next&id=15da704b732332cc1e8f121f624e5e6c05124c5d


> 
> --- Patch [2]: [PATCH v4 2/6] cxl/region: Generalize endpoint position mapping ---
> commit 74f53df9f58a0339cb5f29038f2e514904e34cf5
> Author: Alison Schofield <alison.schofield@intel.com>
> 
> cxl/region: Generalize endpoint position mapping
> 
> This commit alters the endpoint position calculation to support
> mixed-granularity regions. It weights each decoder's contribution by its
> relative granularity instead of assuming a uniform granularity across the
> interleave hierarchy.
> 
> > diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> > index 3b640c9ba5a08..4f367feaf6c84 100644
> > --- a/drivers/cxl/core/region.c
> > +++ b/drivers/cxl/core/region.c
> [ ... ]
> > @@ -1929,9 +1934,10 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range,
> >  		return rc;
> >  	}
> >  	cxlsd = to_cxl_switch_decoder(dev);
> > -	*ways = cxlsd->cxld.interleave_ways;
> > +	ways = cxlsd->cxld.interleave_ways;
> > +	*gran = cxlsd->cxld.interleave_granularity;
> >  
> > -	for (int i = 0; i < *ways; i++) {
> > +	for (int i = 0; i < ways; i++) {
> >  		if (cxlsd->target[i] == port->parent_dport) {
> >  			*pos = i;
> >  			rc = 0;
> 
> [Severity: High]
> This is a pre-existing issue, but could the error handling path just after
> this loop trigger a use-after-free?
> 
> Looking at find_pos_and_gran(), if the loop completes without finding a
> match, rc remains -ENXIO. Immediately after the loop, put_device(dev) is
> called, and then dev_err() formats an error message using cxlsd:
> 
> 	put_device(dev);
> 
> 	if (rc)
> 		dev_err(port->uport_dev,
> 			"failed to find %s:%s in target list of %s\n",
> 			dev_name(&port->dev),
> 			dev_name(port->parent_dport->dport_dev),
> 			dev_name(&cxlsd->cxld.dev));
> 
> Since cxlsd is derived from dev, does calling put_device() before dev_err()
> release the structure prematurely and cause a read of freed memory?
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/cover.1787255388.git.alison.schofield@intel.com?part=2