FAILED: patch "[PATCH] cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER" failed to apply to 6.12-stable tree

PATCH New [email protected] 2 participants 5 messages Sep 3 – Sep 4

Subsystems (2)

Stable branch CXL

lore

Share & tools

lore

[email protected]

author maintainer

2026-09-03 13:06 UTC #0 lore raw

The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 29458e62d0829cbc99435f3e44fd560f9bbf1da7
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090316-sincere-breeding-8254@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 29458e62d0829cbc99435f3e44fd560f9bbf1da7 Mon Sep 17 00:00:00 2001
From: Terry Bowman <[email protected]>
Date: Mon, 3 Aug 2026 17:17:57 -0500
Subject: [PATCH] cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER
register read

cxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl() loop bounded by sizeof(struct aer_capability_regs). This struct is a software layout and its embedded struct pcie_tlp_log is larger than the on-wire AER capability. As a result the loop reads past the mapped AER register block.

The over-read also populates the software-only tail fields including header_log.header_len. An out-of-range header_len passed to pcie_print_tlp_log() can then loop past the header log buffer and cause a second out-of-bounds read.

The read was correct when introduced, but struct pcie_tlp_log has since grown (Header Log and TLP Prefix Log sizes, header_len and flit fields), so sizeof(struct aer_capability_regs) no longer matches the physical AER capability.

Bound the read to the physical AER registers, header through the 16 byte Header Log. Zero the destination first so the software-only fields are deterministic.

Fixes 6ac07883dbb5 ("cxl/pci: Add RCH downstream port error logging")

Reported-by Sashiko <[email protected]>

Cc [email protected]

Signed-off-by Terry Bowman <[email protected]>

Reviewed-by Alison Schofield <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Dave Jiang <[email protected]>

drivers/cxl/core/ras_rch.c +16 -1

index 0a8b3b9b6388..8a3965edaa12 100644
@@ -58,13 +58,28 @@ void cxl_disable_rch_root_ints(struct cxl_dport *dport)
 static bool cxl_rch_get_aer_info(void __iomem *aer_base,
 				 struct aer_capability_regs *aer_regs)
 {
-	int read_cnt = sizeof(struct aer_capability_regs) / sizeof(u32);
+	/*
+	 * Bound the copy to the physically-defined AER registers (header
+	 * through the 16-byte Header Log). struct aer_capability_regs is a
+	 * software layout whose embedded struct pcie_tlp_log is larger than
+	 * the on-wire AER capability; copying sizeof(*aer_regs) would
+	 * over-read the RCRB-mapped MMIO block.
+	 */
+	int read_cnt = (PCI_ERR_HEADER_LOG + 16) / sizeof(u32);
 	u32 *aer_regs_buf = (u32 *)aer_regs;
 	int n;
 
 	if (!aer_base)
 		return false;
 
+	/*
+	 * Zero the destination so the software-only tail fields
+	 * (e.g. header_log.header_len) are deterministic rather than
+	 * left as uninitialized stack, which could drive a bogus loop
+	 * length in pcie_print_tlp_log().
+	 */
+	memset(aer_regs, 0, sizeof(*aer_regs));
+
 	/* Use readl() to guarantee 32-bit accesses */
 	for (n = 0; n < read_cnt; n++)
 		aer_regs_buf[n] = readl(aer_base + n * sizeof(u32));

Sasha Levin

maintainer

2026-09-04 15:28 UTC #1 lore raw

PATCH 1/4 cxl/pci: Remove unnecessary CXL Endpoint handling helper functions

From: Terry Bowman <[email protected]>

[ Upstream commit ca3d1a53e62093d17436abd447463da9c0f4e56b ]

The CXL driver's cxl_handle_endpoint_cor_ras()/cxl_handle_endpoint_ras() are unnecessary helper functions used only for Endpoints. Remove these functions as they are not common for all CXL devices and do not provide value for EP handling.

Rename __cxl_handle_ras to cxl_handle_ras() and __cxl_handle_cor_ras() to cxl_handle_cor_ras().

Signed-off-by Terry Bowman <[email protected]>

Reviewed-by Kuppuswamy Sathyanarayanan <[email protected]>

Reviewed-by Jonathan Cameron <[email protected]>

Reviewed-by Dave Jiang <[email protected]>

Tested-by Joshua Hahn <[email protected]>

Reviewed-by Dan Williams <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Dan Williams <[email protected]>

Signed-off-by Dave Jiang <[email protected]>

Stable-dep-of: 29458e62d082 ("cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/cxl/core/pci.c | 26 ++++++++------------------
 1 file changed, 8 insertions(+), 18 deletions(-)

drivers/cxl/core/pci.c +8 ~~-18~~

index 5b46bc46aaa95..c70b75a6f6fe5 100644
@@ -650,8 +650,8 @@ void read_cdat_data(struct cxl_port *port)
 }
 EXPORT_SYMBOL_NS_GPL(read_cdat_data, CXL);
 
-static void __cxl_handle_cor_ras(struct cxl_dev_state *cxlds,
-				 void __iomem *ras_base)
+static void cxl_handle_cor_ras(struct cxl_dev_state *cxlds,
+			       void __iomem *ras_base)
 {
 	void __iomem *addr;
 	u32 status;

@@ -667,11 +667,6 @@ static void __cxl_handle_cor_ras(struct cxl_dev_state *cxlds,
 	}
 }
 
-static void cxl_handle_endpoint_cor_ras(struct cxl_dev_state *cxlds)
-{
-	return __cxl_handle_cor_ras(cxlds, cxlds->regs.ras);
-}
-
 /* CXL spec rev3.0 8.2.4.16.1 */
 static void header_log_copy(void __iomem *ras_base, u32 *log)
 {

@@ -693,8 +688,8 @@ static void header_log_copy(void __iomem *ras_base, u32 *log)
  * Log the state of the RAS status registers and prepare them to log the
  * next error status. Return 1 if reset needed.
  */
-static bool __cxl_handle_ras(struct cxl_dev_state *cxlds,
-				  void __iomem *ras_base)
+static bool cxl_handle_ras(struct cxl_dev_state *cxlds,
+			   void __iomem *ras_base)
 {
 	u32 hl[CXL_HEADERLOG_SIZE_U32];
 	void __iomem *addr;

@@ -727,11 +722,6 @@ static bool __cxl_handle_ras(struct cxl_dev_state *cxlds,
 	return true;
 }
 
-static bool cxl_handle_endpoint_ras(struct cxl_dev_state *cxlds)
-{
-	return __cxl_handle_ras(cxlds, cxlds->regs.ras);
-}
-
 #ifdef CONFIG_PCIEAER_CXL
 
 static void cxl_dport_map_rch_aer(struct cxl_dport *dport)

@@ -810,13 +800,13 @@ EXPORT_SYMBOL_NS_GPL(cxl_dport_init_ras_reporting, CXL);
 static void cxl_handle_rdport_cor_ras(struct cxl_dev_state *cxlds,
 					  struct cxl_dport *dport)
 {
-	return __cxl_handle_cor_ras(cxlds, dport->regs.ras);
+	return cxl_handle_cor_ras(cxlds, dport->regs.ras);
 }
 
 static bool cxl_handle_rdport_ras(struct cxl_dev_state *cxlds,
 				       struct cxl_dport *dport)
 {
-	return __cxl_handle_ras(cxlds, dport->regs.ras);
+	return cxl_handle_ras(cxlds, dport->regs.ras);
 }
 
 /*

@@ -913,7 +903,7 @@ void cxl_cor_error_detected(struct pci_dev *pdev)
 		if (cxlds->rcd)
 			cxl_handle_rdport_errors(cxlds);
 
-		cxl_handle_endpoint_cor_ras(cxlds);
+		cxl_handle_cor_ras(cxlds, cxlds->regs.ras);
 	}
 }
 EXPORT_SYMBOL_NS_GPL(cxl_cor_error_detected, CXL);

@@ -942,7 +932,7 @@ pci_ers_result_t cxl_error_detected(struct pci_dev *pdev,
 		 * chance the situation is recoverable dump the status of the RAS
 		 * capability registers and bounce the active state of the memdev.
 		 */
-		ue = cxl_handle_endpoint_ras(cxlds);
+		ue = cxl_handle_ras(cxlds, cxlds->regs.ras);
 	}

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-04 15:28 UTC #2 lore raw

PATCH 2/4 cxl/pci: Remove unnecessary CXL RCH handling helper functions

From: Terry Bowman <[email protected]>

[ Upstream commit eb78ef4d6f0e51243c1ee117f801dbc503e886ab ]

cxl_handle_rdport_cor_ras() and cxl_handle_rdport_ras() are specific to Restricted CXL Host (RCH) handling. Improve readability and maintainability by replacing these and instead using the common cxl_handle_cor_ras() and cxl_handle_ras() functions.

Signed-off-by Terry Bowman <[email protected]>

Reviewed-by Alejandro Lucero <[email protected]>

Reviewed-by Dave Jiang <[email protected]>

Reviewed-by Jonathan Cameron <[email protected]>

Reviewed-by Dan Williams <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Dan Williams <[email protected]>

Signed-off-by Dave Jiang <[email protected]>

Stable-dep-of: 29458e62d082 ("cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/cxl/core/pci.c | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

drivers/cxl/core/pci.c +2 ~~-14~~

index c70b75a6f6fe5..42fc18878b0d6 100644
@@ -797,18 +797,6 @@ void cxl_dport_init_ras_reporting(struct cxl_dport *dport, struct device *host)
 }
 EXPORT_SYMBOL_NS_GPL(cxl_dport_init_ras_reporting, CXL);
 
-static void cxl_handle_rdport_cor_ras(struct cxl_dev_state *cxlds,
-					  struct cxl_dport *dport)
-{
-	return cxl_handle_cor_ras(cxlds, dport->regs.ras);
-}
-
-static bool cxl_handle_rdport_ras(struct cxl_dev_state *cxlds,
-				       struct cxl_dport *dport)
-{
-	return cxl_handle_ras(cxlds, dport->regs.ras);
-}
-
 /*
  * Copy the AER capability registers using 32 bit read accesses.
  * This is necessary because RCRB AER capability is MMIO mapped. Clear the

@@ -878,9 +866,9 @@ static void cxl_handle_rdport_errors(struct cxl_dev_state *cxlds)
 	pci_print_aer(pdev, severity, &aer_regs);
 
 	if (severity == AER_CORRECTABLE)
-		cxl_handle_rdport_cor_ras(cxlds, dport);
+		cxl_handle_cor_ras(cxlds, dport->regs.ras);
 	else
-		cxl_handle_rdport_ras(cxlds, dport);
+		cxl_handle_ras(cxlds, dport->regs.ras);
 }
 
 #else

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-04 15:28 UTC #3 lore raw

PATCH 3/4 cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c

In reply to Sasha Levin

From: Dave Jiang <[email protected]>

[ Upstream commit 7ff8b1d60881c5f97b5ae426e14d2822917d3b69 ]

Create new config CONFIG_CXL_RAS and put all CXL RAS items behind the config. The config will depend on CPER and PCIE AER to build. Move the related VH RAS code from core/pci.c to core/ras.c.

Restricted CXL host (RCH) RAS functions will be moved in a future patch.

Cc Robert Richter <[email protected]>

Reviewed-by Joshua Hahn <[email protected]>

Reviewed-by Jonathan Cameron <[email protected]>

Signed-off-by Dave Jiang <[email protected]>

Reviewed-by Alison Schofield <[email protected]>

Co-developed-by Terry Bowman <[email protected]>

Signed-off-by Terry Bowman <[email protected]>

Reviewed-by Dan Williams <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Dan Williams <[email protected]>

Signed-off-by Dave Jiang <[email protected]>

[ sashal: Reduced backport -- upstream 7ff8b1d60881c touches 8 file(s), this
backport carries 6. Not backported here:
drivers/cxl/cxl.h
drivers/cxl/cxlpci.h
drivers/cxl/Kconfig
This note is generated from the file lists only; see the resolution record for the reasoning. ]

Stable-dep-of: 29458e62d082 ("cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/cxl/core/Makefile  |   2 +
 drivers/cxl/core/core.h    |  12 ++
 drivers/cxl/core/pci.c     | 296 -------------------------------------
 drivers/cxl/core/ras.c     | 186 +++++++++++++++++++++++
 drivers/cxl/core/ras_rch.c | 121 +++++++++++++++
 tools/testing/cxl/Kbuild   |   2 +
 6 files changed, 323 insertions(+), 296 deletions(-)
 create mode 100644 drivers/cxl/core/ras.c
 create mode 100644 drivers/cxl/core/ras_rch.c

drivers/cxl/core/Makefile +2 -0

index 9259bcc6773c8..c673775cd1917 100644
@@ -14,5 +14,7 @@ cxl_core-y += pci.o
 cxl_core-y += hdm.o
 cxl_core-y += pmu.o
 cxl_core-y += cdat.o
+cxl_core-y += ras.o
+cxl_core-$(CONFIG_PCIEAER_CXL) += ras_rch.o
 cxl_core-$(CONFIG_TRACING) += trace.o
 cxl_core-$(CONFIG_CXL_REGION) += region.o

drivers/cxl/core/core.h +12 -0

index 0c62b4069ba00..efe567c679a20 100644
@@ -110,4 +110,16 @@ bool cxl_need_node_perf_attrs_update(int nid);
 int cxl_port_get_switch_dport_bandwidth(struct cxl_port *port,
 					struct access_coordinate *c);
 
+struct cxl_dev_state;
+bool cxl_handle_ras(struct cxl_dev_state *cxlds, void __iomem *ras_base);
+void cxl_handle_cor_ras(struct cxl_dev_state *cxlds, void __iomem *ras_base);
+
+#ifdef CONFIG_PCIEAER_CXL
+void cxl_dport_map_rch_aer(struct cxl_dport *dport);
+void cxl_disable_rch_root_ints(struct cxl_dport *dport);
+void cxl_handle_rdport_errors(struct cxl_dev_state *cxlds);
+#else
+static inline void cxl_handle_rdport_errors(struct cxl_dev_state *cxlds) { }
+#endif
+
 #endif /* __CXL_CORE_H__ */

drivers/cxl/core/pci.c +0 ~~-296~~

302 lines not on this page · raw message

drivers/cxl/core/ras.c new file +186 -0

186 lines not on this page · raw message

drivers/cxl/core/ras_rch.c new file +121 -0

121 lines not on this page · raw message

tools/testing/cxl/Kbuild +2 -0

index b1256fee3567f..773e56e3aa1d4 100644
@@ -61,6 +61,8 @@ cxl_core-y += $(CXL_CORE_SRC)/pci.o
 cxl_core-y += $(CXL_CORE_SRC)/hdm.o
 cxl_core-y += $(CXL_CORE_SRC)/pmu.o
 cxl_core-y += $(CXL_CORE_SRC)/cdat.o
+cxl_core-y += $(CXL_CORE_SRC)/ras.o
+cxl_core-$(CONFIG_PCIEAER_CXL) += $(CXL_CORE_SRC)/ras_rch.o
 cxl_core-$(CONFIG_TRACING) += $(CXL_CORE_SRC)/trace.o
 cxl_core-$(CONFIG_CXL_REGION) += $(CXL_CORE_SRC)/region.o
 cxl_core-y += config_check.o

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-04 15:28 UTC #4 lore raw

PATCH 4/4 cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read

In reply to Sasha Levin

From: Terry Bowman <[email protected]>

[ Upstream commit 29458e62d0829cbc99435f3e44fd560f9bbf1da7 ]

Bound the read to the physical AER registers, header through the 16 byte Header Log. Zero the destination first so the software-only fields are deterministic.

Fixes 6ac07883dbb5 ("cxl/pci: Add RCH downstream port error logging")

Reported-by Sashiko <[email protected]>

Cc [email protected]

Signed-off-by Terry Bowman <[email protected]>

Reviewed-by Alison Schofield <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Dave Jiang <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/cxl/core/ras_rch.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

drivers/cxl/core/ras_rch.c +16 -1

index ed58afd18ecc9..5170cebf6637b 100644
@@ -58,13 +58,28 @@ void cxl_disable_rch_root_ints(struct cxl_dport *dport)
 static bool cxl_rch_get_aer_info(void __iomem *aer_base,
 				 struct aer_capability_regs *aer_regs)
 {
-	int read_cnt = sizeof(struct aer_capability_regs) / sizeof(u32);
+	/*
+	 * Bound the copy to the physically-defined AER registers (header
+	 * through the 16-byte Header Log). struct aer_capability_regs is a
+	 * software layout whose embedded struct pcie_tlp_log is larger than
+	 * the on-wire AER capability; copying sizeof(*aer_regs) would
+	 * over-read the RCRB-mapped MMIO block.
+	 */
+	int read_cnt = (PCI_ERR_HEADER_LOG + 16) / sizeof(u32);
 	u32 *aer_regs_buf = (u32 *)aer_regs;
 	int n;
 
 	if (!aer_base)
 		return false;
 
+	/*
+	 * Zero the destination so the software-only tail fields
+	 * (e.g. header_log.header_len) are deterministic rather than
+	 * left as uninitialized stack, which could drive a bogus loop
+	 * length in pcie_print_tlp_log().
+	 */
+	memset(aer_regs, 0, sizeof(*aer_regs));
+
 	/* Use readl() to guarantee 32-bit accesses */
 	for (n = 0; n < read_cnt; n++)
 		aer_regs_buf[n] = readl(aer_base + n * sizeof(u32));

Signature · 1 line

2.53.0