On Fri, 14 Apr 2023 11:53:55 -0700
Dan Williams <dan.j.williams@xxxxxxxxx> wrote:
> Decoders committed with 0-size lead to later crashes on shutdown as
> __cxl_dpa_release() assumes a 'struct resource' has been established in
> the in 'cxlds->dpa_res'. Just fail the driver load in this instance
> since there are deeper problems with the enumeration or the setup when
> this happens.
>
> Fixes: 9c57cde0dcbd ("cxl/hdm: Enumerate allocated DPA")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Dan Williams <dan.j.williams@xxxxxxxxx>
What happened to these? Seem not to have gone upstream yet.
This seems reasonable to me as well
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
> ---
> drivers/cxl/core/hdm.c | 15 ++++++++++++---
> 1 file changed, 12 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> index 02cc2c38b44b..35b338b716fe 100644
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c
> @@ -269,8 +269,11 @@ static int __cxl_dpa_reserve(struct cxl_endpoint_decoder *cxled,
>
> lockdep_assert_held_write(&cxl_dpa_rwsem);
>
> - if (!len)
> - goto success;
> + if (!len) {
> + dev_warn(dev, "decoder%d.%d: empty reservation attempted\n",
> + port->id, cxled->cxld.id);
> + return -EINVAL;
> + }
>
> if (cxled->dpa_res) {
> dev_dbg(dev, "decoder%d.%d: existing allocation %pr assigned\n",
> @@ -323,7 +326,6 @@ static int __cxl_dpa_reserve(struct cxl_endpoint_decoder *cxled,
> cxled->mode = CXL_DECODER_MIXED;
> }
>
> -success:
> port->hdm_end++;
> get_device(&cxled->cxld.dev);
> return 0;
> @@ -833,6 +835,13 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
> port->id, cxld->id);
> return -ENXIO;
> }
> +
> + if (size == 0) {
> + dev_warn(&port->dev,
> + "decoder%d.%d: Committed with zero size\n",
> + port->id, cxld->id);
> + return -ENXIO;
> + }
> port->commit_end = cxld->id;
> } else {
> /* unless / until type-2 drivers arrive, assume type-3 */
>
