From: Richard Cheng <icheng@nvidia.com>
To: jic23@kernel.org, dave@stgolabs.net, dave.jiang@intel.com,
alison.schofield@intel.com, vishal.l.verma@intel.com
Cc: iweiny@kernel.org, ming.li@zohomail.com, kaihengf@nvidia.com,
kobak@nvidia.com, newtonl@nvidia.com, kristinc@nvidia.com,
linux-cxl@vger.kernel.org, linux-kernel@vger.kernel.org,
Richard Cheng <icheng@nvidia.com>
Subject: [PATCH v8 2/4] cxl/region: Don't leak tolerated RAM -EFAULT from unmapped poison scan
Date: Tue, 22 Sep 2026 18:11:27 +0800 [thread overview]
Message-ID: <20260922101129.52794-3-icheng@nvidia.com> (raw)
In-Reply-To: <20260922101129.52794-1-icheng@nvidia.com>
CXL 3.0 section 8.2.9.8.4.1 requires Get Poison List to return Invalid
Physical Address for a volatile range when the device does not support
volatile poison lists.
For example, consider a memdev with a single RAM partition and a
committed decoder covering only part of it:
RAM partition: [ committed decoder ][ unmapped tail ]
On a device without volatile poison-list support, querying this tail
returns Invalid Physical Address, which cxl_internal_send_cmd() maps
to -EFAULT. The driver tolerates this response for RAM because volatile
poison-list support is optional.
When cxl_get_poison_unmapped() was converted to iterate over partitions,
the RAM-specific error handling became a continue without clearing rc.
If no subsequent query overwrites rc, the function returns the tolerated
-EFAULT and incorrectly reports the enumeration as failed.
Clear rc before continuing, restoring the previous handling of this
expected response for RAM partitions.
Fixes: be5cbd0840275 ("cxl: Kill enum cxl_decoder_mode")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
drivers/cxl/core/region.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 7c7287315d72..042356c71ed7 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2954,8 +2954,10 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
if (!length)
continue;
rc = cxl_mem_get_poison(cxlmd, offset, length, NULL);
- if (poison_efault_forgiven(rc, cxlds->part[i].mode))
+ if (poison_efault_forgiven(rc, cxlds->part[i].mode)) {
+ rc = 0;
continue;
+ }
if (rc)
break;
}
--
2.43.0
next prev parent reply other threads:[~2026-09-22 10:12 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-22 10:11 [PATCH v8 0/4] cxl: Repair poison enumeration regressions Richard Cheng
2026-09-22 10:11 ` [PATCH v8 1/4] cxl/region: Scan all partitions for unmapped poison Richard Cheng
2026-09-22 10:11 ` Richard Cheng [this message]
2026-09-25 23:18 ` [PATCH v8 2/4] cxl/region: Don't leak tolerated RAM -EFAULT from unmapped poison scan Jonathan Cameron
2026-09-22 10:11 ` [PATCH v8 3/4] cxl/region: Start unmapped poison scan at the committed decoder boundary Richard Cheng
2026-09-22 10:11 ` [PATCH v8 4/4] cxl/memdev: Don't overwrite the error from an earlier partition poison query Richard Cheng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260922101129.52794-3-icheng@nvidia.com \
--to=icheng@nvidia.com \
--cc=alison.schofield@intel.com \
--cc=dave.jiang@intel.com \
--cc=dave@stgolabs.net \
--cc=iweiny@kernel.org \
--cc=jic23@kernel.org \
--cc=kaihengf@nvidia.com \
--cc=kobak@nvidia.com \
--cc=kristinc@nvidia.com \
--cc=linux-cxl@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ming.li@zohomail.com \
--cc=newtonl@nvidia.com \
--cc=vishal.l.verma@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®