Re: [PATCH v9 03/11] cxl: Share HDM decoder decode logic

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds stack read leaking kernel memory to userspace via decoder target maps when processing decoders with more than 8 interleave ways.
- [High] Endianness bug when extracting 8-bit Target IDs via a 64-bit union, leading to broken routing on big-endian architectures.
--

--- Patch [3]: [PATCH v9 03/11] cxl: Share HDM decoder decode logic ---
commit 0c55ebf0416f52a7748df44eabd5450eb7aba244
Author: Srirangan Madhavan <smadhavan@nvidia.com>

cxl: Share HDM decoder decode logic

This commit moves HDM decoder register decoding into a shared helper function.
It consolidates the validation of base, size, interleave, target type, and
enable state to simplify early PCI HDM cache setup.

> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> index 83cda63f76a5a..e9e00c68a0ad9 100644
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c
> @@ -952,6 +952,7 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
>  	u32 remainder;
>  	int i, rc;
>  	u32 ctrl;
> +	struct cxl_decoder_settings settings;
>  	union {
>  		u64 value;
>  		unsigned char target_id[8];
>  	} target_list;

[ ... ]

> @@ -1036,32 +1030,11 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
[ ... ]
>  	if (!cxled) {
> -		lo = readl(hdm + CXL_HDM_DECODER0_TL_LOW(which));
> -		hi = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(which));
> -		target_list.value = (hi << 32) + lo;
> -		cxld->targets = target_list.value;
>  		for (i = 0; i < cxld->interleave_ways; i++)
>  			cxld->target_map[i] = target_list.target_id[i];

[Severity: High]
This isn't a bug introduced by this patch, but does this loop cause an
out-of-bounds stack read if cxld->interleave_ways is greater than 8?

The target_list union is only 8 bytes wide, but CXL decoders can have up to 16
interleave ways. This would result in reading uninitialized stack memory into
the target_map array.

[Severity: High]
This is a pre-existing issue, but can using a union to map a 64-bit integer
to a byte array lead to endianness issues here?

On big-endian CPUs, target_list.value would store the bytes in reverse order
compared to little-endian CPUs, causing the loop to map memory to the wrong
routing targets.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=3