* Re: [PATCH v2 1/2] cxl/port: Clear cached dport pointers when a dport is removed
2026-09-28 23:03 ` [PATCH v2 1/2] cxl/port: Clear cached dport pointers when a dport is removed Dave Jiang
@ 2026-09-29 2:57 ` Li Ming
2026-09-29 16:45 ` Gregory Price
1 sibling, 0 replies; 3+ messages in thread
From: Li Ming @ 2026-09-29 2:57 UTC (permalink / raw)
To: Dave Jiang, linux-cxl
Cc: dave, jic23, alison.schofield, icheng, stable, Jonathan Cameron
在 2026/9/29 07:03, Dave Jiang 写道:
> Switch decoders cache dport pointers in cxlsd->target[], and nothing
> clears them when a dport is freed. Readers then dereference freed memory.
>
> KASAN caught it under a cxl_test load/unload loop with concurrent sysfs
> reads (abbreviated).
>
> Clear the matching slots from cxl_dport_remove(), walking the port's
> decoders the way cxl_port_update_decoder_targets() does on the add side.
> Scan all nr_targets slots, the target[] allocation size, and clear every
> hit.
>
> Fixes: 8330671c57c7 ("cxl: Add helper to delete dport")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> Assisted-by: LLM
> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Li Ming <ming.li@zohomail.com>
> ---
> Found by KASAN while stress-testing a separate dport locking fix, not from a
> failure report.
>
> Reproducer: cxl_test, CONFIG_KASAN=y, 12 concurrent readers cat'ing
> /sys/bus/cxl/devices/*/target_list while cxl_test is unloaded and reloaded.
>
> With the fix reverted the UAF lands ~1s into the first unload, on the trace
> above. With it applied, 36 cycles across two runs are clean: no KASAN
> report, no WARNING, lockdep never self-disables. clear_decoder_target()
> fired 2916 times during those runs, so the new path ran under the load.
>
> KASAN only reports once per boot unless kasan_multi_shot is set
> (report_enabled(), mm/kasan/report.c), so the reverted-fix run cannot show
> a per-cycle count - one report is the ceiling, not the frequency.
>
> target_list output is unaffected. Clearing a slot truncates the list at the
> first NULL, so that was the regression to watch for: 88 target_list files,
> no empty values before or after, and the multiset of values is unchanged
> once the ida-assigned decoder names are stripped.
>
> Enumeration is unchanged too: 15 memdev, 12 port, 15 endpoint, 192 decoder.
> ---
> drivers/cxl/core/port.c | 29 +++++++++++++++++++++++++++++
> 1 file changed, 29 insertions(+)
>
> diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
> index 625e4aa427db..6ff3353865e3 100644
> --- a/drivers/cxl/core/port.c
> +++ b/drivers/cxl/core/port.c
> @@ -1089,11 +1089,40 @@ static void cond_cxl_root_unlock(struct cxl_port *port)
> device_unlock(&port->dev);
> }
>
> +static int clear_decoder_target(struct device *dev, void *data)
> +{
> + struct cxl_dport *dport = data;
> + struct cxl_switch_decoder *cxlsd;
> +
> + if (!is_switch_decoder(dev))
> + return 0;
> +
> + cxlsd = to_cxl_switch_decoder(dev);
> + guard(rwsem_write)(&cxl_rwsem.region);
> +
> + /*
> + * A dport can occupy more than one position of an interleave, so
> + * scan the whole target list rather than stopping at the first hit.
> + */
> + for (int i = 0; i < cxlsd->nr_targets; i++) {
> + if (cxlsd->target[i] != dport)
> + continue;
> + cxlsd->target[i] = NULL;
> + dev_dbg(dev, "dport%d removed from target list, index %d\n",
> + dport->port_id, i);
> + }
> +
> + return 0;
> +}
> +
> static void cxl_dport_remove(void *data)
> {
> struct cxl_dport *dport = data;
> struct cxl_port *port = dport->port;
>
> + /* counterpart of cxl_port_update_decoder_targets() */
> + device_for_each_child(&port->dev, dport, clear_decoder_target);
> +
> port->nr_dports--;
> xa_erase(&port->dports, (unsigned long) dport->dport_dev);
> put_device(dport->dport_dev);
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v2 1/2] cxl/port: Clear cached dport pointers when a dport is removed
2026-09-28 23:03 ` [PATCH v2 1/2] cxl/port: Clear cached dport pointers when a dport is removed Dave Jiang
2026-09-29 2:57 ` Li Ming
@ 2026-09-29 16:45 ` Gregory Price
1 sibling, 0 replies; 3+ messages in thread
From: Gregory Price @ 2026-09-29 16:45 UTC (permalink / raw)
To: Dave Jiang
Cc: linux-cxl, dave, jic23, alison.schofield, ming.li, icheng, stable,
Jonathan Cameron
On Mon, Sep 28, 2026 at 04:03:40PM -0700, Dave Jiang wrote:
> Switch decoders cache dport pointers in cxlsd->target[], and nothing
> clears them when a dport is freed. Readers then dereference freed memory.
>
> KASAN caught it under a cxl_test load/unload loop with concurrent sysfs
> reads (abbreviated).
>
> Clear the matching slots from cxl_dport_remove(), walking the port's
> decoders the way cxl_port_update_decoder_targets() does on the add side.
> Scan all nr_targets slots, the target[] allocation size, and clear every
> hit.
>
> Fixes: 8330671c57c7 ("cxl: Add helper to delete dport")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> Assisted-by: LLM
> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
^ permalink raw reply [flat|nested] 3+ messages in thread