diff options
| author | Koba Ko <kobak@nvidia.com> | 2026-04-14 10:45:27 +0800 |
|---|---|---|
| committer | Dave Jiang <dave.jiang@intel.com> | 2026-06-04 08:44:00 -0700 |
| commit | 16329b510f76e5b824e05bf8add8b29850f1f16f (patch) | |
| tree | 19b9840d68e4c97563cdf6c286912925d0b31cb5 /drivers/cxl | |
| parent | 574eda81d0a7238af3268e88f9effe22953460bc (diff) | |
cxl/region: Validate partition index before array access
construct_region() reads cxled->part and uses it to index
cxlds->part[] without checking for a negative value. If the
partition was never resolved, part remains at its initial value
of -1, causing an out-of-bounds array access.
Add a guard to return -EBUSY when part is negative.
The check was dropped during a merge.
Signed-off-by: Koba Ko <kobak@nvidia.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260414024527.3399590-1-kobak@nvidia.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Diffstat (limited to 'drivers/cxl')
| -rw-r--r-- | drivers/cxl/core/region.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index e50dc716d4e8..cc41c08c0c0c 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -3714,6 +3714,9 @@ static struct cxl_region *construct_region(struct cxl_root_decoder *cxlrd, int rc, part = READ_ONCE(cxled->part); struct cxl_region *cxlr; + if (part < 0) + return ERR_PTR(-EBUSY); + do { cxlr = __create_region(cxlrd, cxlds->part[part].mode, atomic_read(&cxlrd->region_id), |