From: Dan Williams dan.j.williams@intel.com
commit 7701c8bef4f14bd9f7940c6ed0e6a73584115a96 upstream.
Decoders committed with 0-size lead to later crashes on shutdown as __cxl_dpa_release() assumes a 'struct resource' has been established in the in 'cxlds->dpa_res'. Just fail the driver load in this instance since there are deeper problems with the enumeration or the setup when this happens.
Fixes: 9c57cde0dcbd ("cxl/hdm: Enumerate allocated DPA") Cc: stable@vger.kernel.org Reviewed-by: Dave Jiang dave.jiang@intel.com Reviewed-by: Alison Schofield alison.schofield@intel.com Link: https://lore.kernel.org/r/168149843516.792294.11872242648319572632.stgit@dwi... Signed-off-by: Dan Williams dan.j.williams@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/cxl/core/hdm.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
--- a/drivers/cxl/core/hdm.c +++ b/drivers/cxl/core/hdm.c @@ -219,8 +219,11 @@ static int __cxl_dpa_reserve(struct cxl_
lockdep_assert_held_write(&cxl_dpa_rwsem);
- if (!len) - goto success; + if (!len) { + dev_warn(dev, "decoder%d.%d: empty reservation attempted\n", + port->id, cxled->cxld.id); + return -EINVAL; + }
if (cxled->dpa_res) { dev_dbg(dev, "decoder%d.%d: existing allocation %pr assigned\n", @@ -273,7 +276,6 @@ static int __cxl_dpa_reserve(struct cxl_ cxled->mode = CXL_DECODER_MIXED; }
-success: port->hdm_end++; get_device(&cxled->cxld.dev); return 0; @@ -732,6 +734,13 @@ static int init_hdm_decoder(struct cxl_p port->id, cxld->id); return -ENXIO; } + + if (size == 0) { + dev_warn(&port->dev, + "decoder%d.%d: Committed with zero size\n", + port->id, cxld->id); + return -ENXIO; + } port->commit_end = cxld->id; } else { /* unless / until type-2 drivers arrive, assume type-3 */