delete_region_store() destroys a region object without checking
CXL_REGION_F_LOCK, unlike commit_store() which refuses locked regions
with -EPERM. A region owned by a memdev-attach provider carries F_LOCK,
and cxl_region_decode_reset() deliberately skips the HDM decoder reset
for F_LOCK regions. As a result, a userspace write to delete_region
tears down the region object but leaves the endpoint HDM decoder
committed with no owning region, which is an orphan, enabled decoder.
Gate delete_region_store() on CXL_REGION_F_LOCK.
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
drivers/cxl/core/region.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 578622240401..cfc9622c9309 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2894,6 +2894,9 @@ static ssize_t delete_region_store(struct device *dev,
if (!cxlr || !sysfs_streq(buf, dev_name(&cxlr->dev)))
return -ENODEV;
+ if (test_bit(CXL_REGION_F_LOCK, &cxlr->flags))
+ return -EPERM;
+
unregister_region(cxlr);
return len;
base-commit: 5ca04f3ba91f1773bbd5da6d9c654ccc1ba7831d
--
2.43.0