[PATCH v4 6/6] cxl/region: Reject poison scan for decoder without a partition
Richard Cheng <[email protected]>
| Newsgroups | org.kernel.vger.linux-cxl,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
__cxl_dpa_reserve() may leave cxled->part at -1 when a decoder's DPA
range doesn't map to any reported partition, while still keeping
dpa_res. poison_by_decoder() then indexes cxlds->part[-1], causing an
out-of-bounds read when poison collection is triggered.
Return -ENODEV before accessing the partition array when no partition was
assigned.
Fixes: be5cbd084027 ("cxl: Kill enum cxl_decoder_mode")
Signed-off-by: Richard Cheng <[email protected]>
---
drivers/cxl/core/region.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index b7dc5d4988da..afe3fb57b7fe 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2954,6 +2954,8 @@ static int poison_by_decoder(struct device *dev, void *arg)
cxled = to_cxl_endpoint_decoder(dev);
if (!cxled->dpa_res)
return rc;
+ if (cxled->part < 0)
+ return -ENODEV;
cxlmd = cxled_to_memdev(cxled);
cxlds = cxlmd->cxlds;
--
2.43.0