| Message ID | 168149843516.792294.11872242648319572632.stgit@dwillia2-xfh.jf.intel.com |
|---|---|
| State | Accepted |
| Commit | 7701c8bef4f14bd9f7940c6ed0e6a73584115a96 |
| Headers | show |
| Series | cxl/hdm: Decoder enumeration fixes | expand |
On Fri, Apr 14, 2023 at 11:53:55AM -0700, Dan Williams wrote: > Decoders committed with 0-size lead to later crashes on shutdown as > __cxl_dpa_release() assumes a 'struct resource' has been established in > the in 'cxlds->dpa_res'. Just fail the driver load in this instance > since there are deeper problems with the enumeration or the setup when > this happens. > > Fixes: 9c57cde0dcbd ("cxl/hdm: Enumerate allocated DPA") > Cc: <stable@vger.kernel.org> > Signed-off-by: Dan Williams <dan.j.williams@intel.com> Reviewed-by: Alison Schofield <alison.schofield@intel.com> > snip
On 4/14/23 11:53 AM, Dan Williams wrote: > Decoders committed with 0-size lead to later crashes on shutdown as > __cxl_dpa_release() assumes a 'struct resource' has been established in > the in 'cxlds->dpa_res'. Just fail the driver load in this instance > since there are deeper problems with the enumeration or the setup when > this happens. > > Fixes: 9c57cde0dcbd ("cxl/hdm: Enumerate allocated DPA") > Cc: <stable@vger.kernel.org> > Signed-off-by: Dan Williams <dan.j.williams@intel.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> > --- > drivers/cxl/core/hdm.c | 15 ++++++++++++--- > 1 file changed, 12 insertions(+), 3 deletions(-) > > diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c > index 02cc2c38b44b..35b338b716fe 100644 > --- a/drivers/cxl/core/hdm.c > +++ b/drivers/cxl/core/hdm.c > @@ -269,8 +269,11 @@ static int __cxl_dpa_reserve(struct cxl_endpoint_decoder *cxled, > > lockdep_assert_held_write(&cxl_dpa_rwsem); > > - if (!len) > - goto success; > + if (!len) { > + dev_warn(dev, "decoder%d.%d: empty reservation attempted\n", > + port->id, cxled->cxld.id); > + return -EINVAL; > + } > > if (cxled->dpa_res) { > dev_dbg(dev, "decoder%d.%d: existing allocation %pr assigned\n", > @@ -323,7 +326,6 @@ static int __cxl_dpa_reserve(struct cxl_endpoint_decoder *cxled, > cxled->mode = CXL_DECODER_MIXED; > } > > -success: > port->hdm_end++; > get_device(&cxled->cxld.dev); > return 0; > @@ -833,6 +835,13 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld, > port->id, cxld->id); > return -ENXIO; > } > + > + if (size == 0) { > + dev_warn(&port->dev, > + "decoder%d.%d: Committed with zero size\n", > + port->id, cxld->id); > + return -ENXIO; > + } > port->commit_end = cxld->id; > } else { > /* unless / until type-2 drivers arrive, assume type-3 */ >
On Fri, 14 Apr 2023 11:53:55 -0700 Dan Williams <dan.j.williams@intel.com> wrote: > Decoders committed with 0-size lead to later crashes on shutdown as > __cxl_dpa_release() assumes a 'struct resource' has been established in > the in 'cxlds->dpa_res'. Just fail the driver load in this instance > since there are deeper problems with the enumeration or the setup when > this happens. > > Fixes: 9c57cde0dcbd ("cxl/hdm: Enumerate allocated DPA") > Cc: <stable@vger.kernel.org> > Signed-off-by: Dan Williams <dan.j.williams@intel.com> What happened to these? Seem not to have gone upstream yet. This seems reasonable to me as well Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> > --- > drivers/cxl/core/hdm.c | 15 ++++++++++++--- > 1 file changed, 12 insertions(+), 3 deletions(-) > > diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c > index 02cc2c38b44b..35b338b716fe 100644 > --- a/drivers/cxl/core/hdm.c > +++ b/drivers/cxl/core/hdm.c > @@ -269,8 +269,11 @@ static int __cxl_dpa_reserve(struct cxl_endpoint_decoder *cxled, > > lockdep_assert_held_write(&cxl_dpa_rwsem); > > - if (!len) > - goto success; > + if (!len) { > + dev_warn(dev, "decoder%d.%d: empty reservation attempted\n", > + port->id, cxled->cxld.id); > + return -EINVAL; > + } > > if (cxled->dpa_res) { > dev_dbg(dev, "decoder%d.%d: existing allocation %pr assigned\n", > @@ -323,7 +326,6 @@ static int __cxl_dpa_reserve(struct cxl_endpoint_decoder *cxled, > cxled->mode = CXL_DECODER_MIXED; > } > > -success: > port->hdm_end++; > get_device(&cxled->cxld.dev); > return 0; > @@ -833,6 +835,13 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld, > port->id, cxld->id); > return -ENXIO; > } > + > + if (size == 0) { > + dev_warn(&port->dev, > + "decoder%d.%d: Committed with zero size\n", > + port->id, cxld->id); > + return -ENXIO; > + } > port->commit_end = cxld->id; > } else { > /* unless / until type-2 drivers arrive, assume type-3 */ >
diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c index 02cc2c38b44b..35b338b716fe 100644 --- a/drivers/cxl/core/hdm.c +++ b/drivers/cxl/core/hdm.c @@ -269,8 +269,11 @@ static int __cxl_dpa_reserve(struct cxl_endpoint_decoder *cxled, lockdep_assert_held_write(&cxl_dpa_rwsem); - if (!len) - goto success; + if (!len) { + dev_warn(dev, "decoder%d.%d: empty reservation attempted\n", + port->id, cxled->cxld.id); + return -EINVAL; + } if (cxled->dpa_res) { dev_dbg(dev, "decoder%d.%d: existing allocation %pr assigned\n", @@ -323,7 +326,6 @@ static int __cxl_dpa_reserve(struct cxl_endpoint_decoder *cxled, cxled->mode = CXL_DECODER_MIXED; } -success: port->hdm_end++; get_device(&cxled->cxld.dev); return 0; @@ -833,6 +835,13 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld, port->id, cxld->id); return -ENXIO; } + + if (size == 0) { + dev_warn(&port->dev, + "decoder%d.%d: Committed with zero size\n", + port->id, cxld->id); + return -ENXIO; + } port->commit_end = cxld->id; } else { /* unless / until type-2 drivers arrive, assume type-3 */
Decoders committed with 0-size lead to later crashes on shutdown as __cxl_dpa_release() assumes a 'struct resource' has been established in the in 'cxlds->dpa_res'. Just fail the driver load in this instance since there are deeper problems with the enumeration or the setup when this happens. Fixes: 9c57cde0dcbd ("cxl/hdm: Enumerate allocated DPA") Cc: <stable@vger.kernel.org> Signed-off-by: Dan Williams <dan.j.williams@intel.com> --- drivers/cxl/core/hdm.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)