[PATCH v2 1/2] cxl/port: Clear cached dport pointers when a dport is removed

[PATCH v2 1/2] cxl/port: Clear cached dport pointers when a dport is removed

[Dave Jiang]

Switch decoders cache dport pointers in cxlsd->target[], and nothing
clears them when a dport is freed. Readers then dereference freed memory.

KASAN caught it under a cxl_test load/unload loop with concurrent sysfs
reads (abbreviated).

Clear the matching slots from cxl_dport_remove(), walking the port's
decoders the way cxl_port_update_decoder_targets() does on the add side.
Scan all nr_targets slots, the target[] allocation size, and clear every
hit.

Fixes: 8330671c57c7 ("cxl: Add helper to delete dport")
Cc: stable@vger.kernel.org
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Assisted-by: LLM
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
---
Found by KASAN while stress-testing a separate dport locking fix, not from a
failure report.

Reproducer: cxl_test, CONFIG_KASAN=y, 12 concurrent readers cat'ing
/sys/bus/cxl/devices/*/target_list while cxl_test is unloaded and reloaded.

With the fix reverted the UAF lands ~1s into the first unload, on the trace
above. With it applied, 36 cycles across two runs are clean: no KASAN
report, no WARNING, lockdep never self-disables. clear_decoder_target()
fired 2916 times during those runs, so the new path ran under the load.

KASAN only reports once per boot unless kasan_multi_shot is set
(report_enabled(), mm/kasan/report.c), so the reverted-fix run cannot show
a per-cycle count - one report is the ceiling, not the frequency.

target_list output is unaffected. Clearing a slot truncates the list at the
first NULL, so that was the regression to watch for: 88 target_list files,
no empty values before or after, and the multiset of values is unchanged
once the ida-assigned decoder names are stripped.

Enumeration is unchanged too: 15 memdev, 12 port, 15 endpoint, 192 decoder.
---
 drivers/cxl/core/port.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
index 625e4aa427db..6ff3353865e3 100644
--- a/drivers/cxl/core/port.c
+++ b/drivers/cxl/core/port.c
@@ -1089,11 +1089,40 @@ static void cond_cxl_root_unlock(struct cxl_port *port)
 		device_unlock(&port->dev);
 }
 
+static int clear_decoder_target(struct device *dev, void *data)
+{
+	struct cxl_dport *dport = data;
+	struct cxl_switch_decoder *cxlsd;
+
+	if (!is_switch_decoder(dev))
+		return 0;
+
+	cxlsd = to_cxl_switch_decoder(dev);
+	guard(rwsem_write)(&cxl_rwsem.region);
+
+	/*
+	 * A dport can occupy more than one position of an interleave, so
+	 * scan the whole target list rather than stopping at the first hit.
+	 */
+	for (int i = 0; i < cxlsd->nr_targets; i++) {
+		if (cxlsd->target[i] != dport)
+			continue;
+		cxlsd->target[i] = NULL;
+		dev_dbg(dev, "dport%d removed from target list, index %d\n",
+			dport->port_id, i);
+	}
+
+	return 0;
+}
+
 static void cxl_dport_remove(void *data)
 {
 	struct cxl_dport *dport = data;
 	struct cxl_port *port = dport->port;
 
+	/* counterpart of cxl_port_update_decoder_targets() */
+	device_for_each_child(&port->dev, dport, clear_decoder_target);
+
 	port->nr_dports--;
 	xa_erase(&port->dports, (unsigned long) dport->dport_dev);
 	put_device(dport->dport_dev);
-- 
2.54.0

Re: [PATCH v2 1/2] cxl/port: Clear cached dport pointers when a dport is removed

[Li Ming]

在 2026/9/29 07:03, Dave Jiang 写道:
> Switch decoders cache dport pointers in cxlsd->target[], and nothing
> clears them when a dport is freed. Readers then dereference freed memory.
>
> KASAN caught it under a cxl_test load/unload loop with concurrent sysfs
> reads (abbreviated).
>
> Clear the matching slots from cxl_dport_remove(), walking the port's
> decoders the way cxl_port_update_decoder_targets() does on the add side.
> Scan all nr_targets slots, the target[] allocation size, and clear every
> hit.
>
> Fixes: 8330671c57c7 ("cxl: Add helper to delete dport")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> Assisted-by: LLM
> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Li Ming <ming.li@zohomail.com>

> ---
> Found by KASAN while stress-testing a separate dport locking fix, not from a
> failure report.
>
> Reproducer: cxl_test, CONFIG_KASAN=y, 12 concurrent readers cat'ing
> /sys/bus/cxl/devices/*/target_list while cxl_test is unloaded and reloaded.
>
> With the fix reverted the UAF lands ~1s into the first unload, on the trace
> above. With it applied, 36 cycles across two runs are clean: no KASAN
> report, no WARNING, lockdep never self-disables. clear_decoder_target()
> fired 2916 times during those runs, so the new path ran under the load.
>
> KASAN only reports once per boot unless kasan_multi_shot is set
> (report_enabled(), mm/kasan/report.c), so the reverted-fix run cannot show
> a per-cycle count - one report is the ceiling, not the frequency.
>
> target_list output is unaffected. Clearing a slot truncates the list at the
> first NULL, so that was the regression to watch for: 88 target_list files,
> no empty values before or after, and the multiset of values is unchanged
> once the ida-assigned decoder names are stripped.
>
> Enumeration is unchanged too: 15 memdev, 12 port, 15 endpoint, 192 decoder.
> ---
>   drivers/cxl/core/port.c | 29 +++++++++++++++++++++++++++++
>   1 file changed, 29 insertions(+)
>
> diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
> index 625e4aa427db..6ff3353865e3 100644
> --- a/drivers/cxl/core/port.c
> +++ b/drivers/cxl/core/port.c
> @@ -1089,11 +1089,40 @@ static void cond_cxl_root_unlock(struct cxl_port *port)
>   		device_unlock(&port->dev);
>   }
>   
> +static int clear_decoder_target(struct device *dev, void *data)
> +{
> +	struct cxl_dport *dport = data;
> +	struct cxl_switch_decoder *cxlsd;
> +
> +	if (!is_switch_decoder(dev))
> +		return 0;
> +
> +	cxlsd = to_cxl_switch_decoder(dev);
> +	guard(rwsem_write)(&cxl_rwsem.region);
> +
> +	/*
> +	 * A dport can occupy more than one position of an interleave, so
> +	 * scan the whole target list rather than stopping at the first hit.
> +	 */
> +	for (int i = 0; i < cxlsd->nr_targets; i++) {
> +		if (cxlsd->target[i] != dport)
> +			continue;
> +		cxlsd->target[i] = NULL;
> +		dev_dbg(dev, "dport%d removed from target list, index %d\n",
> +			dport->port_id, i);
> +	}
> +
> +	return 0;
> +}
> +
>   static void cxl_dport_remove(void *data)
>   {
>   	struct cxl_dport *dport = data;
>   	struct cxl_port *port = dport->port;
>   
> +	/* counterpart of cxl_port_update_decoder_targets() */
> +	device_for_each_child(&port->dev, dport, clear_decoder_target);
> +
>   	port->nr_dports--;
>   	xa_erase(&port->dports, (unsigned long) dport->dport_dev);
>   	put_device(dport->dport_dev);

Re: [PATCH v2 1/2] cxl/port: Clear cached dport pointers when a dport is removed

[Gregory Price]

On Mon, Sep 28, 2026 at 04:03:40PM -0700, Dave Jiang wrote:
> Switch decoders cache dport pointers in cxlsd->target[], and nothing
> clears them when a dport is freed. Readers then dereference freed memory.
> 
> KASAN caught it under a cxl_test load/unload loop with concurrent sysfs
> reads (abbreviated).
> 
> Clear the matching slots from cxl_dport_remove(), walking the port's
> decoders the way cxl_port_update_decoder_targets() does on the add side.
> Scan all nr_targets slots, the target[] allocation size, and clear every
> hit.
> 
> Fixes: 8330671c57c7 ("cxl: Add helper to delete dport")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> Assisted-by: LLM
> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>

Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>