[PATCH 0/9] dax/hmem: Add tests for the dax_hmem takeover capability

[PATCH 0/9] dax/hmem: Add tests for the dax_hmem takeover capability

[Dan Williams]

Given all the cross subsystem dependencies needed to make this solution
work, it needs to have a unit test to keep it functional.

On the path to writing that, several fixes fell out, but not to Smita's
code, to mine. One use-after-free has been there since the original
automatic region assembly code.

Here is a preview of the core of the test I will submit to the cxl-cli project:

---
modprobe cxl_mock_mem && modprobe cxl_test hmem_test=1

dax=$(find_dax_cxl)
[[ "$dax" == "" ]] && err $LINENO
dax=$(find_dax_hmem)
[[ "$dax" != "" ]] && err $LINENO

unload

modprobe cxl_mock_mem && modprobe cxl_test fail_autoassemble hmem_test=1

dax=$(find_dax_cxl)
[[ "$dax" != "" ]] && err $LINENO
dax=$(find_dax_hmem)
[[ "$dax" == "" ]] && err $LINENO

unload
---

This builds on Smita's series [1] pushed out to for-7.1/dax-hmem in
cxl.git [2].

[1]: http://lore.kernel.org/20260322195343.206900-1-Smita.KoralahalliChannabasappa@amd.com
[2]: https://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl.git/log/?h=for-7.1/dax-hmem

Dan Williams (9):
  cxl/region: Fix use-after-free from auto assembly failure
  dax/cxl: Fix HMEM dependencies
  cxl/region: Limit visibility of cxl_region_contains_resource()
  cxl/region: Constify cxl_region_resource_contains()
  dax/hmem: Reduce visibility of dax_cxl coordination symbols
  dax/hmem: Fix singleton confusion between dax_hmem_work and hmem
    devices
  dax/hmem: Parent dax_hmem devices
  tools/testing/cxl: Simulate auto-assembly failure
  tools/testing/cxl: Test dax_hmem takeover of CXL regions

 drivers/dax/Kconfig                |   6 +-
 drivers/cxl/cxl.h                  |  11 ++-
 drivers/dax/bus.h                  |  15 +++-
 include/cxl/cxl.h                  |  15 ----
 tools/testing/cxl/test/mock.h      |   8 ++
 drivers/cxl/core/region.c          |  68 +++++++++++++++--
 drivers/dax/hmem/device.c          |  28 ++++---
 drivers/dax/hmem/hmem.c            | 115 +++++++++++++++--------------
 tools/testing/cxl/test/cxl.c       |  66 +++++++++++++++++
 tools/testing/cxl/test/hmem_test.c |  47 ++++++++++++
 tools/testing/cxl/test/mem.c       |   3 +
 tools/testing/cxl/test/mock.c      |  50 +++++++++++++
 tools/testing/cxl/Kbuild           |   7 ++
 tools/testing/cxl/test/Kbuild      |   1 +
 14 files changed, 344 insertions(+), 96 deletions(-)
 delete mode 100644 include/cxl/cxl.h
 create mode 100644 tools/testing/cxl/test/hmem_test.c


base-commit: 51d2fa02c0e4b3b23c4484f2af9b6d65c35471e8
-- 
2.53.0

[PATCH 1/9] cxl/region: Fix use-after-free from auto assembly failure

[Dan Williams]

The following crash signature results from region destruction while an
endpoint decoder is staged, but not fully attached.

---
 BUG: KASAN: slab-use-after-free in __cxl_decoder_detach+0x724/0x830 [cxl_core]
 Read of size 8 at addr ffff888265638840 by task modprobe/1287

 Call Trace:
  <TASK>
  dump_stack_lvl+0x68/0x90
  print_report+0x170/0x4e2
  kasan_report+0xc2/0x1a0
  __cxl_decoder_detach+0x724/0x830 [cxl_core]
  cxl_decoder_detach+0x6c/0x100 [cxl_core]
  unregister_region+0x88/0x140 [cxl_core]
  devres_release_all+0x172/0x230
---

The "staged" state is established by cxl_region_attach_auto() and finalized
by cxl_region_attach_position(). When that is finalized a memdev removal
event will destroy regions before endpoint decoders. However, in the
interim the memdev removal will falsely assume that the endpoint decoder is
unattached. Later, the eventual region removal finds the stale pointer to
the now freed endpoint decoder.

Introduce CXL_DECODER_STATE_AUTO_STAGED and cxl_cancel_auto_attach() to
cleanup this interim state.

Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery")
Cc: <stable@vger.kernel.org>
Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
 drivers/cxl/cxl.h         |  6 +++--
 drivers/cxl/core/region.c | 54 ++++++++++++++++++++++++++++++++++++++-
 2 files changed, 57 insertions(+), 3 deletions(-)

diff --git a/drivers/cxl/cxl.h b/drivers/cxl/cxl.h
index 9b947286eb9b..30a31968f266 100644
--- a/drivers/cxl/cxl.h
+++ b/drivers/cxl/cxl.h
@@ -378,12 +378,14 @@ struct cxl_decoder {
 };
 
 /*
- * Track whether this decoder is reserved for region autodiscovery, or
- * free for userspace provisioning.
+ * Track whether this decoder is free for userspace provisioning, reserved for
+ * region autodiscovery, whether it is started connecting (awaiting other
+ * peers), or has completed auto assembly.
  */
 enum cxl_decoder_state {
 	CXL_DECODER_STATE_MANUAL,
 	CXL_DECODER_STATE_AUTO,
+	CXL_DECODER_STATE_AUTO_STAGED,
 };
 
 /**
diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index f7b20f60ac5c..b72556c1458b 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -1064,6 +1064,14 @@ static int cxl_rr_ep_add(struct cxl_region_ref *cxl_rr,
 
 	if (!cxld->region) {
 		cxld->region = cxlr;
+
+		/*
+		 * Now that cxld->region is set the intermediate staging state
+		 * can be cleared.
+		 */
+		if (cxld == &cxled->cxld &&
+		    cxled->state == CXL_DECODER_STATE_AUTO_STAGED)
+			cxled->state = CXL_DECODER_STATE_AUTO;
 		get_device(&cxlr->dev);
 	}
 
@@ -1805,6 +1813,7 @@ static int cxl_region_attach_auto(struct cxl_region *cxlr,
 	pos = p->nr_targets;
 	p->targets[pos] = cxled;
 	cxled->pos = pos;
+	cxled->state = CXL_DECODER_STATE_AUTO_STAGED;
 	p->nr_targets++;
 
 	return 0;
@@ -2154,6 +2163,47 @@ static int cxl_region_attach(struct cxl_region *cxlr,
 	return 0;
 }
 
+static int cxl_region_by_target(struct device *dev, const void *data)
+{
+	const struct cxl_endpoint_decoder *cxled = data;
+	struct cxl_region_params *p;
+	struct cxl_region *cxlr;
+
+	if (!is_cxl_region(dev))
+		return 0;
+
+	cxlr = to_cxl_region(dev);
+	p = &cxlr->params;
+	return p->targets[cxled->pos] == cxled;
+}
+
+/*
+ * When an auto-region fails to assemble the decoder may be listed as a target,
+ * but not fully attached.
+ */
+static void cxl_cancel_auto_attach(struct cxl_endpoint_decoder *cxled)
+{
+	struct cxl_region_params *p;
+	struct cxl_region *cxlr;
+	int pos = cxled->pos;
+
+	if (cxled->state != CXL_DECODER_STATE_AUTO_STAGED)
+		return;
+
+	struct device *dev __free(put_device) = bus_find_device(
+		&cxl_bus_type, NULL, cxled, cxl_region_by_target);
+	if (!dev)
+		return;
+
+	cxlr = to_cxl_region(dev);
+	p = &cxlr->params;
+
+	p->nr_targets--;
+	cxled->state = CXL_DECODER_STATE_AUTO;
+	cxled->pos = -1;
+	p->targets[pos] = NULL;
+}
+
 static struct cxl_region *
 __cxl_decoder_detach(struct cxl_region *cxlr,
 		     struct cxl_endpoint_decoder *cxled, int pos,
@@ -2177,8 +2227,10 @@ __cxl_decoder_detach(struct cxl_region *cxlr,
 		cxled = p->targets[pos];
 	} else {
 		cxlr = cxled->cxld.region;
-		if (!cxlr)
+		if (!cxlr) {
+			cxl_cancel_auto_attach(cxled);
 			return NULL;
+		}
 		p = &cxlr->params;
 	}
 
-- 
2.53.0

Re: [PATCH 1/9] cxl/region: Fix use-after-free from auto assembly failure

[Dave Jiang]

On 3/26/26 10:28 PM, Dan Williams wrote:
> The following crash signature results from region destruction while an
> endpoint decoder is staged, but not fully attached.
> 
> ---
>  BUG: KASAN: slab-use-after-free in __cxl_decoder_detach+0x724/0x830 [cxl_core]
>  Read of size 8 at addr ffff888265638840 by task modprobe/1287
> 
>  Call Trace:
>   <TASK>
>   dump_stack_lvl+0x68/0x90
>   print_report+0x170/0x4e2
>   kasan_report+0xc2/0x1a0
>   __cxl_decoder_detach+0x724/0x830 [cxl_core]
>   cxl_decoder_detach+0x6c/0x100 [cxl_core]
>   unregister_region+0x88/0x140 [cxl_core]
>   devres_release_all+0x172/0x230
> ---
> 
> The "staged" state is established by cxl_region_attach_auto() and finalized
> by cxl_region_attach_position(). When that is finalized a memdev removal
> event will destroy regions before endpoint decoders. However, in the
> interim the memdev removal will falsely assume that the endpoint decoder is
> unattached. Later, the eventual region removal finds the stale pointer to
> the now freed endpoint decoder.
> 
> Introduce CXL_DECODER_STATE_AUTO_STAGED and cxl_cancel_auto_attach() to
> cleanup this interim state.
> 
> Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery")
> Cc: <stable@vger.kernel.org>
> Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>


> ---
>  drivers/cxl/cxl.h         |  6 +++--
>  drivers/cxl/core/region.c | 54 ++++++++++++++++++++++++++++++++++++++-
>  2 files changed, 57 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/cxl/cxl.h b/drivers/cxl/cxl.h
> index 9b947286eb9b..30a31968f266 100644
> --- a/drivers/cxl/cxl.h
> +++ b/drivers/cxl/cxl.h
> @@ -378,12 +378,14 @@ struct cxl_decoder {
>  };
>  
>  /*
> - * Track whether this decoder is reserved for region autodiscovery, or
> - * free for userspace provisioning.
> + * Track whether this decoder is free for userspace provisioning, reserved for
> + * region autodiscovery, whether it is started connecting (awaiting other
> + * peers), or has completed auto assembly.
>   */
>  enum cxl_decoder_state {
>  	CXL_DECODER_STATE_MANUAL,
>  	CXL_DECODER_STATE_AUTO,
> +	CXL_DECODER_STATE_AUTO_STAGED,
>  };
>  
>  /**
> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index f7b20f60ac5c..b72556c1458b 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c
> @@ -1064,6 +1064,14 @@ static int cxl_rr_ep_add(struct cxl_region_ref *cxl_rr,
>  
>  	if (!cxld->region) {
>  		cxld->region = cxlr;
> +
> +		/*
> +		 * Now that cxld->region is set the intermediate staging state
> +		 * can be cleared.
> +		 */
> +		if (cxld == &cxled->cxld &&
> +		    cxled->state == CXL_DECODER_STATE_AUTO_STAGED)
> +			cxled->state = CXL_DECODER_STATE_AUTO;
>  		get_device(&cxlr->dev);
>  	}
>  
> @@ -1805,6 +1813,7 @@ static int cxl_region_attach_auto(struct cxl_region *cxlr,
>  	pos = p->nr_targets;
>  	p->targets[pos] = cxled;
>  	cxled->pos = pos;
> +	cxled->state = CXL_DECODER_STATE_AUTO_STAGED;
>  	p->nr_targets++;
>  
>  	return 0;
> @@ -2154,6 +2163,47 @@ static int cxl_region_attach(struct cxl_region *cxlr,
>  	return 0;
>  }
>  
> +static int cxl_region_by_target(struct device *dev, const void *data)
> +{
> +	const struct cxl_endpoint_decoder *cxled = data;
> +	struct cxl_region_params *p;
> +	struct cxl_region *cxlr;
> +
> +	if (!is_cxl_region(dev))
> +		return 0;
> +
> +	cxlr = to_cxl_region(dev);
> +	p = &cxlr->params;
> +	return p->targets[cxled->pos] == cxled;
> +}
> +
> +/*
> + * When an auto-region fails to assemble the decoder may be listed as a target,
> + * but not fully attached.
> + */
> +static void cxl_cancel_auto_attach(struct cxl_endpoint_decoder *cxled)
> +{
> +	struct cxl_region_params *p;
> +	struct cxl_region *cxlr;
> +	int pos = cxled->pos;
> +
> +	if (cxled->state != CXL_DECODER_STATE_AUTO_STAGED)
> +		return;
> +
> +	struct device *dev __free(put_device) = bus_find_device(
> +		&cxl_bus_type, NULL, cxled, cxl_region_by_target);
> +	if (!dev)
> +		return;
> +
> +	cxlr = to_cxl_region(dev);
> +	p = &cxlr->params;
> +
> +	p->nr_targets--;
> +	cxled->state = CXL_DECODER_STATE_AUTO;
> +	cxled->pos = -1;
> +	p->targets[pos] = NULL;
> +}
> +
>  static struct cxl_region *
>  __cxl_decoder_detach(struct cxl_region *cxlr,
>  		     struct cxl_endpoint_decoder *cxled, int pos,
> @@ -2177,8 +2227,10 @@ __cxl_decoder_detach(struct cxl_region *cxlr,
>  		cxled = p->targets[pos];
>  	} else {
>  		cxlr = cxled->cxld.region;
> -		if (!cxlr)
> +		if (!cxlr) {
> +			cxl_cancel_auto_attach(cxled);
>  			return NULL;
> +		}
>  		p = &cxlr->params;
>  	}
>  

Re: [PATCH 1/9] cxl/region: Fix use-after-free from auto assembly failure

[Alison Schofield]

On Thu, Mar 26, 2026 at 10:28:13PM -0700, Dan Williams wrote:
> The following crash signature results from region destruction while an
> endpoint decoder is staged, but not fully attached.
> 
> ---
>  BUG: KASAN: slab-use-after-free in __cxl_decoder_detach+0x724/0x830 [cxl_core]
>  Read of size 8 at addr ffff888265638840 by task modprobe/1287
> 
>  Call Trace:
>   <TASK>
>   dump_stack_lvl+0x68/0x90
>   print_report+0x170/0x4e2
>   kasan_report+0xc2/0x1a0
>   __cxl_decoder_detach+0x724/0x830 [cxl_core]
>   cxl_decoder_detach+0x6c/0x100 [cxl_core]
>   unregister_region+0x88/0x140 [cxl_core]
>   devres_release_all+0x172/0x230
> ---
> 
> The "staged" state is established by cxl_region_attach_auto() and finalized
> by cxl_region_attach_position(). When that is finalized a memdev removal
> event will destroy regions before endpoint decoders. However, in the
> interim the memdev removal will falsely assume that the endpoint decoder is
> unattached. Later, the eventual region removal finds the stale pointer to
> the now freed endpoint decoder.

I'm wondering how this is exposed. What is 'eventual region removal'? 

The region driver does not clean up after failed auto assembly.
The cxl-cli cannot because topology is broken.

How did you get here?

> 
> Introduce CXL_DECODER_STATE_AUTO_STAGED and cxl_cancel_auto_attach() to
> cleanup this interim state.
> 
> Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery")
> Cc: <stable@vger.kernel.org>
> Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
> ---
>  drivers/cxl/cxl.h         |  6 +++--
>  drivers/cxl/core/region.c | 54 ++++++++++++++++++++++++++++++++++++++-
>  2 files changed, 57 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/cxl/cxl.h b/drivers/cxl/cxl.h
> index 9b947286eb9b..30a31968f266 100644
> --- a/drivers/cxl/cxl.h
> +++ b/drivers/cxl/cxl.h
> @@ -378,12 +378,14 @@ struct cxl_decoder {
>  };
>  
>  /*
> - * Track whether this decoder is reserved for region autodiscovery, or
> - * free for userspace provisioning.
> + * Track whether this decoder is free for userspace provisioning, reserved for
> + * region autodiscovery, whether it is started connecting (awaiting other
> + * peers), or has completed auto assembly.
>   */
>  enum cxl_decoder_state {
>  	CXL_DECODER_STATE_MANUAL,
>  	CXL_DECODER_STATE_AUTO,
> +	CXL_DECODER_STATE_AUTO_STAGED,
>  };
>  
>  /**
> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index f7b20f60ac5c..b72556c1458b 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c
> @@ -1064,6 +1064,14 @@ static int cxl_rr_ep_add(struct cxl_region_ref *cxl_rr,
>  
>  	if (!cxld->region) {
>  		cxld->region = cxlr;
> +
> +		/*
> +		 * Now that cxld->region is set the intermediate staging state
> +		 * can be cleared.
> +		 */
> +		if (cxld == &cxled->cxld &&
> +		    cxled->state == CXL_DECODER_STATE_AUTO_STAGED)
> +			cxled->state = CXL_DECODER_STATE_AUTO;
>  		get_device(&cxlr->dev);
>  	}
>  
> @@ -1805,6 +1813,7 @@ static int cxl_region_attach_auto(struct cxl_region *cxlr,
>  	pos = p->nr_targets;
>  	p->targets[pos] = cxled;
>  	cxled->pos = pos;
> +	cxled->state = CXL_DECODER_STATE_AUTO_STAGED;
>  	p->nr_targets++;
>  
>  	return 0;
> @@ -2154,6 +2163,47 @@ static int cxl_region_attach(struct cxl_region *cxlr,
>  	return 0;
>  }
>  
> +static int cxl_region_by_target(struct device *dev, const void *data)
> +{
> +	const struct cxl_endpoint_decoder *cxled = data;
> +	struct cxl_region_params *p;
> +	struct cxl_region *cxlr;
> +
> +	if (!is_cxl_region(dev))
> +		return 0;
> +
> +	cxlr = to_cxl_region(dev);
> +	p = &cxlr->params;
> +	return p->targets[cxled->pos] == cxled;
> +}
> +
> +/*
> + * When an auto-region fails to assemble the decoder may be listed as a target,
> + * but not fully attached.
> + */
> +static void cxl_cancel_auto_attach(struct cxl_endpoint_decoder *cxled)
> +{
> +	struct cxl_region_params *p;
> +	struct cxl_region *cxlr;
> +	int pos = cxled->pos;
> +
> +	if (cxled->state != CXL_DECODER_STATE_AUTO_STAGED)
> +		return;
> +
> +	struct device *dev __free(put_device) = bus_find_device(
> +		&cxl_bus_type, NULL, cxled, cxl_region_by_target);
> +	if (!dev)
> +		return;
> +
> +	cxlr = to_cxl_region(dev);
> +	p = &cxlr->params;
> +
> +	p->nr_targets--;
> +	cxled->state = CXL_DECODER_STATE_AUTO;
> +	cxled->pos = -1;
> +	p->targets[pos] = NULL;
> +}
> +
>  static struct cxl_region *
>  __cxl_decoder_detach(struct cxl_region *cxlr,
>  		     struct cxl_endpoint_decoder *cxled, int pos,
> @@ -2177,8 +2227,10 @@ __cxl_decoder_detach(struct cxl_region *cxlr,
>  		cxled = p->targets[pos];
>  	} else {
>  		cxlr = cxled->cxld.region;
> -		if (!cxlr)
> +		if (!cxlr) {
> +			cxl_cancel_auto_attach(cxled);
>  			return NULL;
> +		}
>  		p = &cxlr->params;
>  	}
>  
> -- 
> 2.53.0
> 

Re: [PATCH 1/9] cxl/region: Fix use-after-free from auto assembly failure

[Dan Williams]

Alison Schofield wrote:
> On Thu, Mar 26, 2026 at 10:28:13PM -0700, Dan Williams wrote:
> > The following crash signature results from region destruction while an
> > endpoint decoder is staged, but not fully attached.
> > 
> > ---
> >  BUG: KASAN: slab-use-after-free in __cxl_decoder_detach+0x724/0x830 [cxl_core]
> >  Read of size 8 at addr ffff888265638840 by task modprobe/1287
> > 
> >  Call Trace:
> >   <TASK>
> >   dump_stack_lvl+0x68/0x90
> >   print_report+0x170/0x4e2
> >   kasan_report+0xc2/0x1a0
> >   __cxl_decoder_detach+0x724/0x830 [cxl_core]
> >   cxl_decoder_detach+0x6c/0x100 [cxl_core]
> >   unregister_region+0x88/0x140 [cxl_core]
> >   devres_release_all+0x172/0x230
> > ---
> > 
> > The "staged" state is established by cxl_region_attach_auto() and finalized
> > by cxl_region_attach_position(). When that is finalized a memdev removal
> > event will destroy regions before endpoint decoders. However, in the
> > interim the memdev removal will falsely assume that the endpoint decoder is
> > unattached. Later, the eventual region removal finds the stale pointer to
> > the now freed endpoint decoder.
> 
> I'm wondering how this is exposed. What is 'eventual region removal'? 
> 
> The region driver does not clean up after failed auto assembly.
> The cxl-cli cannot because topology is broken.
> 
> How did you get here?

tl;dr: "modprobe -r cxl_test"

When the cxl_acpi driver is removed the CXL Window root decoders are
destroyed along with any regions that were in the process of being
created.

If one of the region's to be cleaned up has a p->targets[] entry setup
by cxl_region_attach_auto(), but not finalized by
cxl_region_attach_position() then there is nothing to stop that @cxled
object from being freed.

The "modprobe -r cxl_test" event destroys all the memdevs. When the
memdev goes to free its decoders it sees that @cxled->cxld.region is not
yet set, assumes it is idle and frees it. Later, unregister_region()
sees the now freed @cxled in its p->targets[] list, tries to
de-reference it and boom.

Re: [PATCH 1/9] cxl/region: Fix use-after-free from auto assembly failure

[Alison Schofield]

On Fri, Mar 27, 2026 at 02:54:24PM -0700, Dan Williams wrote:
> Alison Schofield wrote:
> > On Thu, Mar 26, 2026 at 10:28:13PM -0700, Dan Williams wrote:
> > > The following crash signature results from region destruction while an
> > > endpoint decoder is staged, but not fully attached.
> > > 
> > > ---
> > >  BUG: KASAN: slab-use-after-free in __cxl_decoder_detach+0x724/0x830 [cxl_core]
> > >  Read of size 8 at addr ffff888265638840 by task modprobe/1287
> > > 
> > >  Call Trace:
> > >   <TASK>
> > >   dump_stack_lvl+0x68/0x90
> > >   print_report+0x170/0x4e2
> > >   kasan_report+0xc2/0x1a0
> > >   __cxl_decoder_detach+0x724/0x830 [cxl_core]
> > >   cxl_decoder_detach+0x6c/0x100 [cxl_core]
> > >   unregister_region+0x88/0x140 [cxl_core]
> > >   devres_release_all+0x172/0x230
> > > ---
> > > 
> > > The "staged" state is established by cxl_region_attach_auto() and finalized
> > > by cxl_region_attach_position(). When that is finalized a memdev removal
> > > event will destroy regions before endpoint decoders. However, in the
> > > interim the memdev removal will falsely assume that the endpoint decoder is
> > > unattached. Later, the eventual region removal finds the stale pointer to
> > > the now freed endpoint decoder.
> > 
> > I'm wondering how this is exposed. What is 'eventual region removal'? 
> > 
> > The region driver does not clean up after failed auto assembly.
> > The cxl-cli cannot because topology is broken.
> > 
> > How did you get here?
> 
> tl;dr: "modprobe -r cxl_test"

That explains it. We did failure test outside cxl/test. No module removes.
I'm curious to see how this fix may help with the stranded broken
region cleanup from userspace. 

Thanks for the detail below too.
> 
> When the cxl_acpi driver is removed the CXL Window root decoders are
> destroyed along with any regions that were in the process of being
> created.
> 
> If one of the region's to be cleaned up has a p->targets[] entry setup
> by cxl_region_attach_auto(), but not finalized by
> cxl_region_attach_position() then there is nothing to stop that @cxled
> object from being freed.
> 
> The "modprobe -r cxl_test" event destroys all the memdevs. When the
> memdev goes to free its decoders it sees that @cxled->cxld.region is not
> yet set, assumes it is idle and frees it. Later, unregister_region()
> sees the now freed @cxled in its p->targets[] list, tries to
> de-reference it and boom.

Re: [PATCH 1/9] cxl/region: Fix use-after-free from auto assembly failure

[Alison Schofield]

On Thu, Mar 26, 2026 at 10:28:13PM -0700, Dan Williams wrote:
> The following crash signature results from region destruction while an
> endpoint decoder is staged, but not fully attached.
> 
> ---
>  BUG: KASAN: slab-use-after-free in __cxl_decoder_detach+0x724/0x830 [cxl_core]
>  Read of size 8 at addr ffff888265638840 by task modprobe/1287
> 
>  Call Trace:
>   <TASK>
>   dump_stack_lvl+0x68/0x90
>   print_report+0x170/0x4e2
>   kasan_report+0xc2/0x1a0
>   __cxl_decoder_detach+0x724/0x830 [cxl_core]
>   cxl_decoder_detach+0x6c/0x100 [cxl_core]
>   unregister_region+0x88/0x140 [cxl_core]
>   devres_release_all+0x172/0x230
> ---
> 
> The "staged" state is established by cxl_region_attach_auto() and finalized
> by cxl_region_attach_position(). When that is finalized a memdev removal
> event will destroy regions before endpoint decoders. However, in the
> interim the memdev removal will falsely assume that the endpoint decoder is
> unattached. Later, the eventual region removal finds the stale pointer to
> the now freed endpoint decoder.
> 
> Introduce CXL_DECODER_STATE_AUTO_STAGED and cxl_cancel_auto_attach() to
> cleanup this interim state.
> 
> Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery")
> Cc: <stable@vger.kernel.org>
> Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>

Reviewed-by: Alison Schofield <alison.schofield@intel.com>

Re: [PATCH 1/9] cxl/region: Fix use-after-free from auto assembly failure

[Ira Weiny]

Dan Williams wrote:
> The following crash signature results from region destruction while an
> endpoint decoder is staged, but not fully attached.
> 
> ---

NIT: When I applied this series to check it out this '---' incorrectly
trimmed the commit message.  Dave should be able to fix that.

So with that fixed:

Reviewed-by: Ira Weiny <ira.weiny@intel.com>


>  BUG: KASAN: slab-use-after-free in __cxl_decoder_detach+0x724/0x830 [cxl_core]
>  Read of size 8 at addr ffff888265638840 by task modprobe/1287
> 
>  Call Trace:
>   <TASK>
>   dump_stack_lvl+0x68/0x90
>   print_report+0x170/0x4e2
>   kasan_report+0xc2/0x1a0
>   __cxl_decoder_detach+0x724/0x830 [cxl_core]
>   cxl_decoder_detach+0x6c/0x100 [cxl_core]
>   unregister_region+0x88/0x140 [cxl_core]
>   devres_release_all+0x172/0x230
> ---
> 
> The "staged" state is established by cxl_region_attach_auto() and finalized
> by cxl_region_attach_position(). When that is finalized a memdev removal
> event will destroy regions before endpoint decoders. However, in the
> interim the memdev removal will falsely assume that the endpoint decoder is
> unattached. Later, the eventual region removal finds the stale pointer to
> the now freed endpoint decoder.
> 
> Introduce CXL_DECODER_STATE_AUTO_STAGED and cxl_cancel_auto_attach() to
> cleanup this interim state.
> 
> Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery")
> Cc: <stable@vger.kernel.org>
> Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
> ---

[snip]

Re: [PATCH 0/9] dax/hmem: Add tests for the dax_hmem takeover capability

[Alison Schofield]

On Thu, Mar 26, 2026 at 10:28:12PM -0700, Dan Williams wrote:
> Given all the cross subsystem dependencies needed to make this solution
> work, it needs to have a unit test to keep it functional.
> 
> On the path to writing that, several fixes fell out, but not to Smita's
> code, to mine. One use-after-free has been there since the original
> automatic region assembly code.
> 
> Here is a preview of the core of the test I will submit to the cxl-cli project:
> 
> ---
> modprobe cxl_mock_mem && modprobe cxl_test hmem_test=1
> 
> dax=$(find_dax_cxl)
> [[ "$dax" == "" ]] && err $LINENO
> dax=$(find_dax_hmem)
> [[ "$dax" != "" ]] && err $LINENO
> 
> unload
> 
> modprobe cxl_mock_mem && modprobe cxl_test fail_autoassemble hmem_test=1
> 
> dax=$(find_dax_cxl)
> [[ "$dax" != "" ]] && err $LINENO
> dax=$(find_dax_hmem)
> [[ "$dax" == "" ]] && err $LINENO
> 
> unload
> ---

I tested the new cxl-test patches following your commands above, and
all good. I'll ask about the race condition in that specific patch.

Tested this set on my real hardware too, confirmed this with Smita's
still passes my hotplug test cases.

snip

Re: [PATCH 0/9] dax/hmem: Add tests for the dax_hmem takeover capability

[Koralahalli Channabasappa, Smita]

On 3/26/2026 10:28 PM, Dan Williams wrote:
> Given all the cross subsystem dependencies needed to make this solution
> work, it needs to have a unit test to keep it functional.
> 
> On the path to writing that, several fixes fell out, but not to Smita's
> code, to mine. One use-after-free has been there since the original
> automatic region assembly code.
> 
> Here is a preview of the core of the test I will submit to the cxl-cli project:
> 
> ---
> modprobe cxl_mock_mem && modprobe cxl_test hmem_test=1
> 
> dax=$(find_dax_cxl)
> [[ "$dax" == "" ]] && err $LINENO
> dax=$(find_dax_hmem)
> [[ "$dax" != "" ]] && err $LINENO
> 
> unload
> 
> modprobe cxl_mock_mem && modprobe cxl_test fail_autoassemble hmem_test=1
> 
> dax=$(find_dax_cxl)
> [[ "$dax" != "" ]] && err $LINENO
> dax=$(find_dax_hmem)
> [[ "$dax" == "" ]] && err $LINENO
> 
> unload
> ---
> 
> This builds on Smita's series [1] pushed out to for-7.1/dax-hmem in
> cxl.git [2].
> 
> [1]: http://lore.kernel.org/20260322195343.206900-1-Smita.KoralahalliChannabasappa@amd.com
> [2]: https://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl.git/log/?h=for-7.1/dax-hmem
> 
> Dan Williams (9):
>    cxl/region: Fix use-after-free from auto assembly failure
>    dax/cxl: Fix HMEM dependencies
>    cxl/region: Limit visibility of cxl_region_contains_resource()
>    cxl/region: Constify cxl_region_resource_contains()
>    dax/hmem: Reduce visibility of dax_cxl coordination symbols
>    dax/hmem: Fix singleton confusion between dax_hmem_work and hmem
>      devices
>    dax/hmem: Parent dax_hmem devices
>    tools/testing/cxl: Simulate auto-assembly failure
>    tools/testing/cxl: Test dax_hmem takeover of CXL regions
> 
>   drivers/dax/Kconfig                |   6 +-
>   drivers/cxl/cxl.h                  |  11 ++-
>   drivers/dax/bus.h                  |  15 +++-
>   include/cxl/cxl.h                  |  15 ----
>   tools/testing/cxl/test/mock.h      |   8 ++
>   drivers/cxl/core/region.c          |  68 +++++++++++++++--
>   drivers/dax/hmem/device.c          |  28 ++++---
>   drivers/dax/hmem/hmem.c            | 115 +++++++++++++++--------------
>   tools/testing/cxl/test/cxl.c       |  66 +++++++++++++++++
>   tools/testing/cxl/test/hmem_test.c |  47 ++++++++++++
>   tools/testing/cxl/test/mem.c       |   3 +
>   tools/testing/cxl/test/mock.c      |  50 +++++++++++++
>   tools/testing/cxl/Kbuild           |   7 ++
>   tools/testing/cxl/test/Kbuild      |   1 +
>   14 files changed, 344 insertions(+), 96 deletions(-)
>   delete mode 100644 include/cxl/cxl.h
>   create mode 100644 tools/testing/cxl/test/hmem_test.c
> 
> 
> base-commit: 51d2fa02c0e4b3b23c4484f2af9b6d65c35471e8

I tested this series. Its working as expected for me. Thanks for the 
incremental.

Thanks
Smita

Re: [PATCH 0/9] dax/hmem: Add tests for the dax_hmem takeover capability

[Dave Jiang]

On 3/30/26 2:12 PM, Koralahalli Channabasappa, Smita wrote:
> On 3/26/2026 10:28 PM, Dan Williams wrote:
>> Given all the cross subsystem dependencies needed to make this solution
>> work, it needs to have a unit test to keep it functional.
>>
>> On the path to writing that, several fixes fell out, but not to Smita's
>> code, to mine. One use-after-free has been there since the original
>> automatic region assembly code.
>>
>> Here is a preview of the core of the test I will submit to the cxl-cli project:
>>
>> ---
>> modprobe cxl_mock_mem && modprobe cxl_test hmem_test=1
>>
>> dax=$(find_dax_cxl)
>> [[ "$dax" == "" ]] && err $LINENO
>> dax=$(find_dax_hmem)
>> [[ "$dax" != "" ]] && err $LINENO
>>
>> unload
>>
>> modprobe cxl_mock_mem && modprobe cxl_test fail_autoassemble hmem_test=1
>>
>> dax=$(find_dax_cxl)
>> [[ "$dax" != "" ]] && err $LINENO
>> dax=$(find_dax_hmem)
>> [[ "$dax" == "" ]] && err $LINENO
>>
>> unload
>> ---
>>
>> This builds on Smita's series [1] pushed out to for-7.1/dax-hmem in
>> cxl.git [2].
>>
>> [1]: http://lore.kernel.org/20260322195343.206900-1-Smita.KoralahalliChannabasappa@amd.com
>> [2]: https://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl.git/log/?h=for-7.1/dax-hmem
>>
>> Dan Williams (9):
>>    cxl/region: Fix use-after-free from auto assembly failure
>>    dax/cxl: Fix HMEM dependencies
>>    cxl/region: Limit visibility of cxl_region_contains_resource()
>>    cxl/region: Constify cxl_region_resource_contains()
>>    dax/hmem: Reduce visibility of dax_cxl coordination symbols
>>    dax/hmem: Fix singleton confusion between dax_hmem_work and hmem
>>      devices
>>    dax/hmem: Parent dax_hmem devices
>>    tools/testing/cxl: Simulate auto-assembly failure
>>    tools/testing/cxl: Test dax_hmem takeover of CXL regions
>>
>>   drivers/dax/Kconfig                |   6 +-
>>   drivers/cxl/cxl.h                  |  11 ++-
>>   drivers/dax/bus.h                  |  15 +++-
>>   include/cxl/cxl.h                  |  15 ----
>>   tools/testing/cxl/test/mock.h      |   8 ++
>>   drivers/cxl/core/region.c          |  68 +++++++++++++++--
>>   drivers/dax/hmem/device.c          |  28 ++++---
>>   drivers/dax/hmem/hmem.c            | 115 +++++++++++++++--------------
>>   tools/testing/cxl/test/cxl.c       |  66 +++++++++++++++++
>>   tools/testing/cxl/test/hmem_test.c |  47 ++++++++++++
>>   tools/testing/cxl/test/mem.c       |   3 +
>>   tools/testing/cxl/test/mock.c      |  50 +++++++++++++
>>   tools/testing/cxl/Kbuild           |   7 ++
>>   tools/testing/cxl/test/Kbuild      |   1 +
>>   14 files changed, 344 insertions(+), 96 deletions(-)
>>   delete mode 100644 include/cxl/cxl.h
>>   create mode 100644 tools/testing/cxl/test/hmem_test.c
>>
>>
>> base-commit: 51d2fa02c0e4b3b23c4484f2af9b6d65c35471e8
> 
> I tested this series. Its working as expected for me. Thanks for the incremental.

Hi Smita. Can you provide a tested-by tag pls?

> 
> Thanks
> Smita
> 

Re: [PATCH 0/9] dax/hmem: Add tests for the dax_hmem takeover capability

[Dave Jiang]

On 3/26/26 10:28 PM, Dan Williams wrote:
> Given all the cross subsystem dependencies needed to make this solution
> work, it needs to have a unit test to keep it functional.
> 
> On the path to writing that, several fixes fell out, but not to Smita's
> code, to mine. One use-after-free has been there since the original
> automatic region assembly code.
> 
> Here is a preview of the core of the test I will submit to the cxl-cli project:
> 
> ---
> modprobe cxl_mock_mem && modprobe cxl_test hmem_test=1
> 
> dax=$(find_dax_cxl)
> [[ "$dax" == "" ]] && err $LINENO
> dax=$(find_dax_hmem)
> [[ "$dax" != "" ]] && err $LINENO
> 
> unload
> 
> modprobe cxl_mock_mem && modprobe cxl_test fail_autoassemble hmem_test=1
> 
> dax=$(find_dax_cxl)
> [[ "$dax" != "" ]] && err $LINENO
> dax=$(find_dax_hmem)
> [[ "$dax" == "" ]] && err $LINENO
> 
> unload
> ---
> 
> This builds on Smita's series [1] pushed out to for-7.1/dax-hmem in
> cxl.git [2].
> 
> [1]: http://lore.kernel.org/20260322195343.206900-1-Smita.KoralahalliChannabasappa@amd.com
> [2]: https://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl.git/log/?h=for-7.1/dax-hmem
> 
> Dan Williams (9):
>   cxl/region: Fix use-after-free from auto assembly failure
>   dax/cxl: Fix HMEM dependencies
>   cxl/region: Limit visibility of cxl_region_contains_resource()
>   cxl/region: Constify cxl_region_resource_contains()
>   dax/hmem: Reduce visibility of dax_cxl coordination symbols
>   dax/hmem: Fix singleton confusion between dax_hmem_work and hmem
>     devices
>   dax/hmem: Parent dax_hmem devices
>   tools/testing/cxl: Simulate auto-assembly failure
>   tools/testing/cxl: Test dax_hmem takeover of CXL regions
> 
>  drivers/dax/Kconfig                |   6 +-
>  drivers/cxl/cxl.h                  |  11 ++-
>  drivers/dax/bus.h                  |  15 +++-
>  include/cxl/cxl.h                  |  15 ----
>  tools/testing/cxl/test/mock.h      |   8 ++
>  drivers/cxl/core/region.c          |  68 +++++++++++++++--
>  drivers/dax/hmem/device.c          |  28 ++++---
>  drivers/dax/hmem/hmem.c            | 115 +++++++++++++++--------------
>  tools/testing/cxl/test/cxl.c       |  66 +++++++++++++++++
>  tools/testing/cxl/test/hmem_test.c |  47 ++++++++++++
>  tools/testing/cxl/test/mem.c       |   3 +
>  tools/testing/cxl/test/mock.c      |  50 +++++++++++++
>  tools/testing/cxl/Kbuild           |   7 ++
>  tools/testing/cxl/test/Kbuild      |   1 +
>  14 files changed, 344 insertions(+), 96 deletions(-)
>  delete mode 100644 include/cxl/cxl.h
>  create mode 100644 tools/testing/cxl/test/hmem_test.c
> 
> 
> base-commit: 51d2fa02c0e4b3b23c4484f2af9b6d65c35471e8

Applied to cxl/next
fe5dfc24e003 tools/testing/cxl: Test dax_hmem takeover of CXL regions
de121c377f88 tools/testing/cxl: Simulate auto-assembly failure
a515eb335f51 dax/hmem: Parent dax_hmem devices
841e96c053f1 dax/hmem: Fix singleton confusion between dax_hmem_work and hmem devices
6c96c76597cc dax/hmem: Reduce visibility of dax_cxl coordination symbols
069a54fd21e8 cxl/region: Constify cxl_region_resource_contains()
b95c14f0dc79 cxl/region: Limit visibility of cxl_region_contains_resource()
6c7077d5ca81 dax/cxl: Fix HMEM dependencies
16413cc33cfd cxl/region: Fix use-after-free from auto assembly failure