Re: [PATCH v2 1/2] cxl/region: Fix use-after-free in find_pos_and_ways() error path

在 2026/7/22 01:37, Alison Schofield 写道:
> The error path releases its reference to a switch decoder before
> logging an error that includes the decoder name. If the released
> reference is the last one, the decoder can be freed before the error
> message accesses its name.
>
> Drop  the reference after the error is reported.
>
> Fixes: d90acdf49e18 ("cxl/region: Add a dev_err() on missing target list entries")
> Signed-off-by: Alison Schofield <[email protected]>

Reviewed-by: Li Ming <[email protected]>


> ---
>
> No changes in v2.
> Reposted in series w the __free change in patch 2/2
>
>
>
>   drivers/cxl/core/region.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index 1e211542b6b6..c86dd9d55e93 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c
> @@ -1938,8 +1938,6 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range,
>   			break;
>   		}
>   	}
> -	put_device(dev);
> -
>   	if (rc)
>   		dev_err(port->uport_dev,
>   			"failed to find %s:%s in target list of %s\n",
> @@ -1947,6 +1945,8 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range,
>   			dev_name(port->parent_dport->dport_dev),
>   			dev_name(&cxlsd->cxld.dev));
>   
> +	put_device(dev);
> +
>   	return rc;
>   }
>   
>
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482