From 15da704b732332cc1e8f121f624e5e6c05124c5d Mon Sep 17 00:00:00 2001 From: Alison Schofield Date: Fri, 24 Jul 2026 15:28:01 -0700 Subject: [PATCH 1/2] cxl/region: Fix use-after-free in find_pos_and_ways() error path The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder can be freed before the error message accesses its name. Drop the reference after the error is reported. Fixes: d90acdf49e18 ("cxl/region: Add a dev_err() on missing target list entries") Reviewed-by: Li Ming Reviewed-by: Jonathan Cameron Signed-off-by: Alison Schofield Link: https://patch.msgid.link/10deb519b543ef693ce23148b509a03fe1c07d0c.1784931354.git.alison.schofield@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/core/region.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index 578622240401..8b0005a57d03 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -1939,14 +1939,13 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range, break; } } - put_device(dev); - if (rc) dev_err(port->uport_dev, "failed to find %s:%s in target list of %s\n", dev_name(&port->dev), - dev_name(port->parent_dport->dport_dev), - dev_name(&cxlsd->cxld.dev)); + dev_name(port->parent_dport->dport_dev), dev_name(dev)); + + put_device(dev); return rc; } From bad0aa134b64f38e29fb3e61176c15680afe8a04 Mon Sep 17 00:00:00 2001 From: Alison Schofield Date: Fri, 24 Jul 2026 15:28:02 -0700 Subject: [PATCH 2/2] cxl/region: Use __free(put_device) in find_pos_and_ways() Use __free(put_device) for the switch decoder reference returned by device_find_child() instead of releasing it with an open-coded put_device(). This matches the scoped device reference handling used elsewhere in the file. Suggested-by: Li Ming Reviewed-by: Li Ming Signed-off-by: Alison Schofield Link: https://patch.msgid.link/550db1771b3d30277988d3e575f1a6893a26b0ae.1784931354.git.alison.schofield@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/core/region.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index 8b0005a57d03..d50b1dfbcd33 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -1914,15 +1914,14 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range, { struct cxl_switch_decoder *cxlsd; struct cxl_port *parent; - struct device *dev; int rc = -ENXIO; parent = parent_port_of(port); if (!parent) return rc; - dev = device_find_child(&parent->dev, range, - match_switch_decoder_by_range); + struct device *dev __free(put_device) = + device_find_child(&parent->dev, range, match_switch_decoder_by_range); if (!dev) { dev_err(port->uport_dev, "failed to find decoder mapping %#llx-%#llx\n", @@ -1945,8 +1944,6 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range, dev_name(&port->dev), dev_name(port->parent_dport->dport_dev), dev_name(dev)); - put_device(dev); - return rc; }