Re: [PATCH v5 4/4] cxl/port: Bound switch decoder target array access by nr_targets

On 8/8/2026 8:05 AM, Alison Schofield wrote:
> Switch decoder target lookups walk the target array using interleave
> ways as the bound. The array is allocated with nr_targets entries, so a
> decoder whose interleave ways exceeds nr_targets reads and writes past
> the end of it. That happens during dport activation, during decoder
> target population, and when userspace reads the target_list attribute.
>
> Bounding by nr_targets alone is not correct either. Commit d6488fee6647
> ("cxl/port: Fix decoder initialization when nr_targets > interleave_ways")
> moved target population to interleave ways precisely so that targets a
> decoder does not use are left unpopulated. Neither field alone is a safe
> bound, so add a helper that returns the minimum of the two and use it at
> every walk of the target array.
>
> Valid configurations keep interleave ways within nr_targets, so this is
> not a behavior change for them.
>
> Fixes: 40ba17afdfab ("cxl/acpi: Introduce cxl_decoder objects")
> Fixes: d6488fee6647 ("cxl/port: Fix decoder initialization when nr_targets > interleave_ways")
> Signed-off-by: Alison Schofield <[email protected]>
Reviewed-by: Li Ming <[email protected]>