Re: [PATCH v3 1/2] cxl/region: Fix use-after-free in find_pos_and_ways() error path

On 7/24/26 3:28 PM, Alison Schofield wrote:
> The error path releases its reference to a switch decoder before
> logging an error that includes the decoder name. If the released
> reference is the last one, the decoder can be freed before the error
> message accesses its name.
> 
> Drop the reference after the error is reported.
> 
> Fixes: d90acdf49e18 ("cxl/region: Add a dev_err() on missing target list entries")
> Reviewed-by: Li Ming <[email protected]>
> Reviewed-by: Jonathan Cameron <[email protected]>
> Signed-off-by: Alison Schofield <[email protected]>

Series applied to cxl/next
15da704b7323
bad0aa134b64

> ---
> 
> Changes in v3:
> - Log dev_name(dev) instead of dev_name(&cxlsd->cxld.dev) (Jonathan)
> - Remove double space in commit log (Jonathan)
> Changes in v2:
> - No changes in v2
> 
> 
>  drivers/cxl/core/region.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index 1e211542b6b6..6d902e1c4161 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c
> @@ -1938,14 +1938,13 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range,
>  			break;
>  		}
>  	}
> -	put_device(dev);
> -
>  	if (rc)
>  		dev_err(port->uport_dev,
>  			"failed to find %s:%s in target list of %s\n",
>  			dev_name(&port->dev),
> -			dev_name(port->parent_dport->dport_dev),
> -			dev_name(&cxlsd->cxld.dev));
> +			dev_name(port->parent_dport->dport_dev), dev_name(dev));
> +
> +	put_device(dev);
>  
>  	return rc;
>  }
> 
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482