Re: [PATCH v3 2/3] cxl/core: Hold the dport host lock across dport lookup and use

[Alison Schofield <alison.schofield@intel.com>]

On Wed, Sep 30, 2026 at 08:23:10AM -0700, Dave Jiang wrote:
> Callers of cxl_pci_find_port() and cxl_mem_find_port() can be handed a
> 'struct cxl_dport' that is already freed, and all four dereference it
> without the lock that would prevent that.
> 
> A dport is kzalloc()'d into a devres group on its host device, so it dies
> when that host unbinds. The host is &port->dev for a switch port and
> port->uport_dev for the root port.
> 
> Both helpers return the dport through an output parameter. The caller's
> port reference pins struct cxl_port, not the dport allocation, and the
> lookup itself is a bare xa_load() under no lock.
> 
> Add cxl_port_dport_host() to name the device that pins a dport, and
> cxl_pci_find_dport() / cxl_mem_find_dport() to look one up with that
> device's lock held and asserted. Convert the four callers to use them and
> bail if the dport is gone. cxl_port_add_dport() already follows this rule.
> 
> cxl_mem_probe() chose its endpoint devm host from dport->rch, which meant
> dereferencing the dport before taking any lock. Use cxl_port_dport_host():
> rch dports only ever land on the root port, so it selects the same device
> without needing the dport.

The Sashiko 'low' issue of dead output params sounds worth a cleanup,
but I didn't look far enough to know if it belongs in this set, or a
follow-on.

With that addressed or deferred - 

Reviewed-by: Alison Schofield <alison.schofield@intel.com>