linux-kernel - Re: [PATCH] cxl: Fix premature commit_end increment on decoder commit failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aXwhVGbKyebNgfKi@U-Q2G32XWJ-0138.local>
Date: Fri, 30 Jan 2026 11:11:16 +0800
From: Yuxiong Wang <yuxiong.wang@...ux.alibaba.com>
To: Alison Schofield <alison.schofield@...el.com>
Cc: dave.jiang@...el.com, ying.huang@...ux.alibaba.com,
	linux-cxl@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] cxl: Fix premature commit_end increment on decoder
 commit failure

On Thu, Jan 29, 2026 at 09:47:35AM -0800, Alison Schofield wrote:
> On Thu, Jan 29, 2026 at 02:45:52PM +0800, Yuxiong Wang wrote:
> > In cxl_decoder_commit(), commit_end is incremented before verifying whether the
> > commit succeeded, and the CXL_DECODER_F_ENABLE bit in cxld->flags is only set
> > after a successful commit. As a result, if the commit fails, commit_end has been
> > incremented and cxld->reset() has no effect since the flag is not set, so commit_end
> > remains incorrectly incremented. The inconsistency between commit_end and
> > CXL_DECODER_F_ENABLE causes failure during subsequent either commit or reset
> > operations.
> > 
> > Fix this by incrementing commit_end only after confirming the commit succeeded.
> > Also, remove the ineffective cxld->reset() call. According to CXL 3.2 Spec 8.2.4.20.12
> 
> DaveJ - Maybe s/3.2/4.0 above on applying please.
> 
> It's the same section either way but lets encourage new references to use the
> latest version of CXL Spec.

Thanks for the advice! I'll refer to the latest version of CXL Spec in future work.

Best Regards,
Yuxiong

> 
> > Committing Decoder Programming, since cxld_await_commit() has cleared the decoder
> > commit bit on failure, no additional reset is required.
> > 
> > Fixes: 176baef ("cxl/hdm: Commit decoder state to hardware")
> > Signed-off-by: Yuxiong Wang <yuxiong.wang@...ux.alibaba.com>
> > Acked-by: Huang Ying <ying.huang@...ux.alibaba.com>
> > Reviewed-by: Dave Jiang <dave.jiang@...el.com>
> > Reviewed-by: Alison Schofield <alison.schofield@...el.com>
> > ---
> > Change log:
> >  * Added CXL 3.2 Spec 8.2.4.20.12 Committing Decoder Programming statement. Thanks
> >    Alison.
> >  * Collected reviewed-by. Thanks Dave and Alison.
> > RFC Link: https://lore.kernel.org/linux-cxl/aXqKC-bscufh1ggq@aschofie-mobl2.lan/
> > ---
> >  drivers/cxl/core/hdm.c | 3 +--
> >  1 file changed, 1 insertion(+), 2 deletions(-)
> > 
> > diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> > index eb5a3a7640c6..912f648a6b7a 100644
> > --- a/drivers/cxl/core/hdm.c
> > +++ b/drivers/cxl/core/hdm.c
> > @@ -844,14 +844,13 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
> >  	scoped_guard(rwsem_read, &cxl_rwsem.dpa)
> >  		setup_hw_decoder(cxld, hdm);
> >  
> > -	port->commit_end++;
> >  	rc = cxld_await_commit(hdm, cxld->id);
> >  	if (rc) {
> >  		dev_dbg(&port->dev, "%s: error %d committing decoder\n",
> >  			dev_name(&cxld->dev), rc);
> > -		cxld->reset(cxld);
> >  		return rc;
> >  	}
> > +	port->commit_end++;
> >  	cxld->flags |= CXL_DECODER_F_ENABLE;
> >  
> >  	return 0;
> > -- 
> > 2.50.1 (Apple Git-155)
> >