Re: [PATCH] cxl/region: Fix use-after-free in find_pos_and_ways() error path

On Mon, Jul 13, 2026 at 10:48:52AM +0800, Li Ming wrote:
> On 7/12/2026 2:07 AM, Alison Schofield wrote:
> > The error path releases its reference to a switch decoder before
> > logging an error that includes the decoder name. If the released
> > reference is the last one, the decoder can be freed before the error
> > message accesses its name.
> >
> > Drop the reference after the error is reported.
> >
> > Found via inspection.
> >
> > Fixes: d90acdf49e18 ("cxl/region: Add a dev_err() on missing target list entries")
> > Signed-off-by: Alison Schofield <[email protected]>
> > ---
> >  drivers/cxl/core/region.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> > index 1e211542b6b6..c86dd9d55e93 100644
> > --- a/drivers/cxl/core/region.c
> > +++ b/drivers/cxl/core/region.c
> > @@ -1938,8 +1938,6 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range,
> >  			break;
> >  		}
> >  	}
> > -	put_device(dev);
> > -
> >  	if (rc)
> >  		dev_err(port->uport_dev,
> >  			"failed to find %s:%s in target list of %s\n",
> > @@ -1947,6 +1945,8 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range,
> >  			dev_name(port->parent_dport->dport_dev),
> >  			dev_name(&cxlsd->cxld.dev));
> >  
> > +	put_device(dev);
> > +
> 
> Is it better to use a __free(put_device) instead of this open-coded?

Yes, but that is out of scope for this specific fix.

Using the __free version changes cleanup for the whole function.
(ie - doesn't just touch this one line above)
I do agree it's best I do that 'now' in series with this patch,
so I'll respin this as a 2 patch series.

-- Alison

> 
> Ming
> 
> >  	return rc;
> >  }
> >  
> >
> > base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
> 
>