Skip to content

Commit

Permalink
cxl/hdm: Remove broken error path
Browse files Browse the repository at this point in the history
Dan reports that cxl_decoder_commit() potentially leaks a hold of
cxl_dpa_rwsem. The potential error case is a "should not" happen
scenario, turn it into a "can not" happen scenario by adding the error
check to cxl_port_setup_targets() where other setting validation occurs.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: http://lore.kernel.org/r/63295673-5d63-4919-b851-3b06d48734c0@moroto.mountain
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Fixes: 176baef ("cxl/hdm: Commit decoder state to hardware")
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
  • Loading branch information
djbw committed Oct 31, 2023
1 parent 69d56b1 commit 5d09c63
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 17 deletions.
19 changes: 2 additions & 17 deletions drivers/cxl/core/hdm.c
Original file line number Diff line number Diff line change
Expand Up @@ -565,17 +565,11 @@ static void cxld_set_type(struct cxl_decoder *cxld, u32 *ctrl)
CXL_HDM_DECODER0_CTRL_HOSTONLY);
}

static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
static void cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
{
struct cxl_dport **t = &cxlsd->target[0];
int ways = cxlsd->cxld.interleave_ways;

if (dev_WARN_ONCE(&cxlsd->cxld.dev,
ways > 8 || ways > cxlsd->nr_targets,
"ways: %d overflows targets: %d\n", ways,
cxlsd->nr_targets))
return -ENXIO;

*tgt = FIELD_PREP(GENMASK(7, 0), t[0]->port_id);
if (ways > 1)
*tgt |= FIELD_PREP(GENMASK(15, 8), t[1]->port_id);
Expand All @@ -591,8 +585,6 @@ static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
*tgt |= FIELD_PREP(GENMASK_ULL(55, 48), t[6]->port_id);
if (ways > 7)
*tgt |= FIELD_PREP(GENMASK_ULL(63, 56), t[7]->port_id);

return 0;
}

/*
Expand Down Expand Up @@ -680,13 +672,7 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
void __iomem *tl_lo = hdm + CXL_HDM_DECODER0_TL_LOW(id);
u64 targets;

rc = cxlsd_set_targets(cxlsd, &targets);
if (rc) {
dev_dbg(&port->dev, "%s: target configuration error\n",
dev_name(&cxld->dev));
goto err;
}

cxlsd_set_targets(cxlsd, &targets);
writel(upper_32_bits(targets), tl_hi);
writel(lower_32_bits(targets), tl_lo);
} else {
Expand All @@ -704,7 +690,6 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)

port->commit_end++;
rc = cxld_await_commit(hdm, cxld->id);
err:
if (rc) {
dev_dbg(&port->dev, "%s: error %d committing decoder\n",
dev_name(&cxld->dev), rc);
Expand Down
8 changes: 8 additions & 0 deletions drivers/cxl/core/region.c
Original file line number Diff line number Diff line change
Expand Up @@ -1196,6 +1196,14 @@ static int cxl_port_setup_targets(struct cxl_port *port,
return rc;
}

if (iw > 8 || iw > cxlsd->nr_targets) {
dev_dbg(&cxlr->dev,
"%s:%s:%s: ways: %d overflows targets: %d\n",
dev_name(port->uport_dev), dev_name(&port->dev),
dev_name(&cxld->dev), iw, cxlsd->nr_targets);
return -ENXIO;
}

if (test_bit(CXL_REGION_F_AUTO, &cxlr->flags)) {
if (cxld->interleave_ways != iw ||
cxld->interleave_granularity != ig ||
Expand Down

0 comments on commit 5d09c63

Please sign in to comment.