Messages in this thread | | | Date | Tue, 2 Apr 2024 09:25:55 -0700 | From | Ira Weiny <> | Subject | Re: [PATCH v2 1/1] cxl/core: Fix initialization of mbox_cmd.size_out in get event |
| |
Kwangjin Ko wrote: > Since mbox_cmd.size_out is overwritten with the actual output size in > the function below, it needs to be initialized every time. > > cxl_internal_send_cmd -> __cxl_pci_mbox_send_cmd > > Problem scenario: > > 1) The size_out variable is initially set to the size of the mailbox. > 2) Read an event. > - size_out is set to 160 bytes(header 32B + one event 128B). > - Two event are created while reading. > 3) Read the new *two* events. > - size_out is still set to 160 bytes. > - Although the value of out_len is 288 bytes, only 160 bytes are > copied from the mailbox register to the local variable. > - record_count is set to 2. > - Accessing records[1] will result in reading incorrect data. > > Signed-off-by: Kwangjin Ko <kwangjin.ko@sk.com>
Tested-by: Ira Weiny <ira.weiny@intel.com> Reviewed-by: Ira Weiny <ira.weiny@intel.com>
> --- > drivers/cxl/core/mbox.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c > index 9adda4795eb7..a38531a055c8 100644 > --- a/drivers/cxl/core/mbox.c > +++ b/drivers/cxl/core/mbox.c > @@ -958,13 +958,14 @@ static void cxl_mem_get_records_log(struct cxl_memdev_state *mds, > .payload_in = &log_type, > .size_in = sizeof(log_type), > .payload_out = payload, > - .size_out = mds->payload_size, > .min_out = struct_size(payload, records, 0), > }; > > do { > int rc, i; > > + mbox_cmd.size_out = mds->payload_size; > + > rc = cxl_internal_send_cmd(mds, &mbox_cmd); > if (rc) { > dev_err_ratelimited(dev, > -- > 2.34.1 >
| |