diff mbox series

[2/2] cxl/hdm: add unlock on error path

Message ID 63295673-5d63-4919-b851-3b06d48734c0@moroto.mountain
State New, archived
Headers show
Series [1/2] cxl/hdm: Fix && vs || bug | expand

Commit Message

Dan Carpenter Oct. 31, 2023, 9:54 a.m. UTC
This error path needs to call up_read(&cxl_dpa_rwsem).

Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
 drivers/cxl/core/hdm.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Dan Williams Oct. 31, 2023, 9:17 p.m. UTC | #1
Dan Carpenter wrote:
> This error path needs to call up_read(&cxl_dpa_rwsem).

This looks correct for what it is, but that error path is a "should
never happen" situation. It would be better to just eliminate that
possibility altogether...

-- >8 --
Subject: cxl/hdm: Remove broken error path

From: Dan Williams <dan.j.williams@intel.com>

Dan reports that cxl_decoder_commit() potentially leaks a hold of
cxl_dpa_rwsem. The potential error case is a "should" not happen
scenario, turn it into a "can not" happen scenario by adding the error
check to cxl_port_setup_targets() where other setting validation occurs.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: http://lore.kernel.org/r/63295673-5d63-4919-b851-3b06d48734c0@moroto.mountain
Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware")
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
 drivers/cxl/core/hdm.c    |   19 ++-----------------
 drivers/cxl/core/region.c |    8 ++++++++
 2 files changed, 10 insertions(+), 17 deletions(-)

diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index af17da8230d5..1cc9be85ba4c 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -565,17 +565,11 @@ static void cxld_set_type(struct cxl_decoder *cxld, u32 *ctrl)
 			  CXL_HDM_DECODER0_CTRL_HOSTONLY);
 }
 
-static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
+static void cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
 {
 	struct cxl_dport **t = &cxlsd->target[0];
 	int ways = cxlsd->cxld.interleave_ways;
 
-	if (dev_WARN_ONCE(&cxlsd->cxld.dev,
-			  ways > 8 || ways > cxlsd->nr_targets,
-			  "ways: %d overflows targets: %d\n", ways,
-			  cxlsd->nr_targets))
-		return -ENXIO;
-
 	*tgt = FIELD_PREP(GENMASK(7, 0), t[0]->port_id);
 	if (ways > 1)
 		*tgt |= FIELD_PREP(GENMASK(15, 8), t[1]->port_id);
@@ -591,8 +585,6 @@ static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
 		*tgt |= FIELD_PREP(GENMASK_ULL(55, 48), t[6]->port_id);
 	if (ways > 7)
 		*tgt |= FIELD_PREP(GENMASK_ULL(63, 56), t[7]->port_id);
-
-	return 0;
 }
 
 /*
@@ -680,13 +672,7 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
 		void __iomem *tl_lo = hdm + CXL_HDM_DECODER0_TL_LOW(id);
 		u64 targets;
 
-		rc = cxlsd_set_targets(cxlsd, &targets);
-		if (rc) {
-			dev_dbg(&port->dev, "%s: target configuration error\n",
-				dev_name(&cxld->dev));
-			goto err;
-		}
-
+		cxlsd_set_targets(cxlsd, &targets);
 		writel(upper_32_bits(targets), tl_hi);
 		writel(lower_32_bits(targets), tl_lo);
 	} else {
@@ -704,7 +690,6 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
 
 	port->commit_end++;
 	rc = cxld_await_commit(hdm, cxld->id);
-err:
 	if (rc) {
 		dev_dbg(&port->dev, "%s: error %d committing decoder\n",
 			dev_name(&cxld->dev), rc);
diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 8d3580a0db53..56e575c79bb4 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -1196,6 +1196,14 @@ static int cxl_port_setup_targets(struct cxl_port *port,
 		return rc;
 	}
 
+	if (iw > 8 || iw > cxlsd->nr_targets) {
+		dev_dbg(&cxlr->dev,
+			"%s:%s:%s: ways: %d overflows targets: %d\n",
+			dev_name(port->uport_dev), dev_name(&port->dev),
+			dev_name(&cxld->dev), iw, cxlsd->nr_targets);
+		return -ENXIO;
+	}
+
 	if (test_bit(CXL_REGION_F_AUTO, &cxlr->flags)) {
 		if (cxld->interleave_ways != iw ||
 		    cxld->interleave_granularity != ig ||
Dave Jiang Oct. 31, 2023, 9:47 p.m. UTC | #2
On 10/31/23 14:17, Dan Williams wrote:
> Dan Carpenter wrote:
>> This error path needs to call up_read(&cxl_dpa_rwsem).
> 
> This looks correct for what it is, but that error path is a "should
> never happen" situation. It would be better to just eliminate that
> possibility altogether...
> 
> -- >8 --
> Subject: cxl/hdm: Remove broken error path
> 
> From: Dan Williams <dan.j.williams@intel.com>
> 
> Dan reports that cxl_decoder_commit() potentially leaks a hold of
> cxl_dpa_rwsem. The potential error case is a "should" not happen
> scenario, turn it into a "can not" happen scenario by adding the error
> check to cxl_port_setup_targets() where other setting validation occurs.
> 
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: http://lore.kernel.org/r/63295673-5d63-4919-b851-3b06d48734c0@moroto.mountain
> Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware")
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>

LGTM

Reviewed-by: Dave Jiang <dave.jiang@intel.com>

> ---
>  drivers/cxl/core/hdm.c    |   19 ++-----------------
>  drivers/cxl/core/region.c |    8 ++++++++
>  2 files changed, 10 insertions(+), 17 deletions(-)
> 
> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> index af17da8230d5..1cc9be85ba4c 100644
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c
> @@ -565,17 +565,11 @@ static void cxld_set_type(struct cxl_decoder *cxld, u32 *ctrl)
>  			  CXL_HDM_DECODER0_CTRL_HOSTONLY);
>  }
>  
> -static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
> +static void cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
>  {
>  	struct cxl_dport **t = &cxlsd->target[0];
>  	int ways = cxlsd->cxld.interleave_ways;
>  
> -	if (dev_WARN_ONCE(&cxlsd->cxld.dev,
> -			  ways > 8 || ways > cxlsd->nr_targets,
> -			  "ways: %d overflows targets: %d\n", ways,
> -			  cxlsd->nr_targets))
> -		return -ENXIO;
> -
>  	*tgt = FIELD_PREP(GENMASK(7, 0), t[0]->port_id);
>  	if (ways > 1)
>  		*tgt |= FIELD_PREP(GENMASK(15, 8), t[1]->port_id);
> @@ -591,8 +585,6 @@ static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
>  		*tgt |= FIELD_PREP(GENMASK_ULL(55, 48), t[6]->port_id);
>  	if (ways > 7)
>  		*tgt |= FIELD_PREP(GENMASK_ULL(63, 56), t[7]->port_id);
> -
> -	return 0;
>  }
>  
>  /*
> @@ -680,13 +672,7 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
>  		void __iomem *tl_lo = hdm + CXL_HDM_DECODER0_TL_LOW(id);
>  		u64 targets;
>  
> -		rc = cxlsd_set_targets(cxlsd, &targets);
> -		if (rc) {
> -			dev_dbg(&port->dev, "%s: target configuration error\n",
> -				dev_name(&cxld->dev));
> -			goto err;
> -		}
> -
> +		cxlsd_set_targets(cxlsd, &targets);
>  		writel(upper_32_bits(targets), tl_hi);
>  		writel(lower_32_bits(targets), tl_lo);
>  	} else {
> @@ -704,7 +690,6 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
>  
>  	port->commit_end++;
>  	rc = cxld_await_commit(hdm, cxld->id);
> -err:
>  	if (rc) {
>  		dev_dbg(&port->dev, "%s: error %d committing decoder\n",
>  			dev_name(&cxld->dev), rc);
> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index 8d3580a0db53..56e575c79bb4 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c
> @@ -1196,6 +1196,14 @@ static int cxl_port_setup_targets(struct cxl_port *port,
>  		return rc;
>  	}
>  
> +	if (iw > 8 || iw > cxlsd->nr_targets) {
> +		dev_dbg(&cxlr->dev,
> +			"%s:%s:%s: ways: %d overflows targets: %d\n",
> +			dev_name(port->uport_dev), dev_name(&port->dev),
> +			dev_name(&cxld->dev), iw, cxlsd->nr_targets);
> +		return -ENXIO;
> +	}
> +
>  	if (test_bit(CXL_REGION_F_AUTO, &cxlr->flags)) {
>  		if (cxld->interleave_ways != iw ||
>  		    cxld->interleave_granularity != ig ||
Ira Weiny Oct. 31, 2023, 10:04 p.m. UTC | #3
Dan Williams wrote:
> Dan Carpenter wrote:
> > This error path needs to call up_read(&cxl_dpa_rwsem).
> 
> This looks correct for what it is, but that error path is a "should
> never happen" situation. It would be better to just eliminate that
> possibility altogether...
> 
> -- >8 --
> Subject: cxl/hdm: Remove broken error path
> 
> From: Dan Williams <dan.j.williams@intel.com>
> 
> Dan reports that cxl_decoder_commit() potentially leaks a hold of
> cxl_dpa_rwsem. The potential error case is a "should" not happen
> scenario, turn it into a "can not" happen scenario by adding the error
> check to cxl_port_setup_targets() where other setting validation occurs.
> 
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: http://lore.kernel.org/r/63295673-5d63-4919-b851-3b06d48734c0@moroto.mountain
> Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware")


Reviewed-by: Ira Weiny <ira.weiny@intel.com>
diff mbox series

Patch

diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index af17da8230d5..0eb580245276 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -684,6 +684,7 @@  static int cxl_decoder_commit(struct cxl_decoder *cxld)
 		if (rc) {
 			dev_dbg(&port->dev, "%s: target configuration error\n",
 				dev_name(&cxld->dev));
+			up_read(&cxl_dpa_rwsem);
 			goto err;
 		}