Skip to content

Commit 9e9d0e6

Browse files
committed
Merge: cxl/region: Avoid null pointer dereference in region lookup
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/4929 # Merge Request Required Information ## Summary of Changes cxl/region: Avoid null pointer dereference in region lookup NOTE: Original upstream patch is to a function that is in a different file upstream, but the changes to __cxl_dpa_to_region are identical. ## Approved Development Ticket JIRA: https://issues.redhat.com/browse/RHEL-51656 CVE: CVE-2024-41084 Signed-off-by: John W. Linville <linville@redhat.com> Approved-by: Myron Stowe <mstowe@redhat.com> Approved-by: Charles Mirabile <cmirabil@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Lucas Zampieri <lzampier@redhat.com>
2 parents 62f7306 + 69c86dc commit 9e9d0e6

File tree

1 file changed

+15
-4
lines changed

1 file changed

+15
-4
lines changed

drivers/cxl/core/memdev.c

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -260,22 +260,33 @@ static int __cxl_dpa_to_region(struct device *dev, void *arg)
260260
{
261261
struct cxl_dpa_to_region_context *ctx = arg;
262262
struct cxl_endpoint_decoder *cxled;
263+
struct cxl_region *cxlr;
263264
u64 dpa = ctx->dpa;
264265

265266
if (!is_endpoint_decoder(dev))
266267
return 0;
267268

268269
cxled = to_cxl_endpoint_decoder(dev);
269-
if (!cxled->dpa_res || !resource_size(cxled->dpa_res))
270+
if (!cxled || !cxled->dpa_res || !resource_size(cxled->dpa_res))
270271
return 0;
271272

272273
if (dpa > cxled->dpa_res->end || dpa < cxled->dpa_res->start)
273274
return 0;
274275

275-
dev_dbg(dev, "dpa:0x%llx mapped in region:%s\n", dpa,
276-
dev_name(&cxled->cxld.region->dev));
276+
/*
277+
* Stop the region search (return 1) when an endpoint mapping is
278+
* found. The region may not be fully constructed so offering
279+
* the cxlr in the context structure is not guaranteed.
280+
*/
281+
cxlr = cxled->cxld.region;
282+
if (cxlr)
283+
dev_dbg(dev, "dpa:0x%llx mapped in region:%s\n", dpa,
284+
dev_name(&cxlr->dev));
285+
else
286+
dev_dbg(dev, "dpa:0x%llx mapped in endpoint:%s\n", dpa,
287+
dev_name(dev));
277288

278-
ctx->cxlr = cxled->cxld.region;
289+
ctx->cxlr = cxlr;
279290

280291
return 1;
281292
}

0 commit comments

Comments
 (0)