Commit 5b43efa1 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'cxl-fixes-6.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl 

Pull cxl fix from Dave Jiang:

 - Fix potential payload size confusion in cxl_mem_get_poison()

* tag 'cxl-fixes-6.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl:
  cxl/core: Fix potential payload size confusion in cxl_mem_get_poison()
parents 08f0677d 4b759dd5

drivers/cxl/core/mbox.c

+17 −21
Original line number Diff line number Diff line
@@ -946,26 +946,23 @@ static void cxl_mem_get_records_log(struct cxl_memdev_state *mds, 
	struct cxl_memdev *cxlmd = mds->cxlds.cxlmd;

	struct device *dev = mds->cxlds.dev;

	struct cxl_get_event_payload *payload;

	struct cxl_mbox_cmd mbox_cmd;

	u8 log_type = type;

	u16 nr_rec;



	mutex_lock(&mds->event.log_lock);

	payload = mds->event.buf;



	mbox_cmd = (struct cxl_mbox_cmd) {

	do {

		int rc, i;

		struct cxl_mbox_cmd mbox_cmd = (struct cxl_mbox_cmd) {

			.opcode = CXL_MBOX_OP_GET_EVENT_RECORD,

			.payload_in = &log_type,

			.size_in = sizeof(log_type),

			.payload_out = payload,

			.size_out = mds->payload_size,

			.min_out = struct_size(payload, records, 0),

		};



	do {

		int rc, i;



		mbox_cmd.size_out = mds->payload_size;



		rc = cxl_internal_send_cmd(mds, &mbox_cmd);

		if (rc) {

			dev_err_ratelimited(dev,
@@ -1297,7 +1294,6 @@ int cxl_mem_get_poison(struct cxl_memdev *cxlmd, u64 offset, u64 len, 
	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);

	struct cxl_mbox_poison_out *po;

	struct cxl_mbox_poison_in pi;

	struct cxl_mbox_cmd mbox_cmd;

	int nr_records = 0;

	int rc;
@@ -1309,7 +1305,8 @@ int cxl_mem_get_poison(struct cxl_memdev *cxlmd, u64 offset, u64 len, 
	pi.offset = cpu_to_le64(offset);

	pi.length = cpu_to_le64(len / CXL_POISON_LEN_MULT);



	mbox_cmd = (struct cxl_mbox_cmd) {

	do {

		struct cxl_mbox_cmd mbox_cmd = (struct cxl_mbox_cmd){

			.opcode = CXL_MBOX_OP_GET_POISON,

			.size_in = sizeof(pi),

			.payload_in = &pi,
@@ -1318,7 +1315,6 @@ int cxl_mem_get_poison(struct cxl_memdev *cxlmd, u64 offset, u64 len, 
			.min_out = struct_size(po, record, 0),

		};



	do {

		rc = cxl_internal_send_cmd(mds, &mbox_cmd);

		if (rc)

			break;