Re: [PATCH v3 3/3] cxl/features: Clamp Get Feature output size to the remaining buffer

[Dave Jiang]

On 6/26/26 3:41 AM, Richard Cheng wrote:
> cxl_get_feature() reads a feature in a loop but passes a fixed size_out
> as the output capacity every iteration. On the last partial iteration
> the buffer has less room left, so a device that returns more than asked
> can overflow feat_out.
> 
> Use the per-iter size data_to_rd_size, which already tracks the
> remaining room, as the output capacity.
> 
> Fixes: 5e5ac21f629d ("cxl/mbox: Add GET_FEATURE mailbox command")
> Signed-off-by: Richard Cheng <icheng@xxxxxxxxxx>

Reviewed-by: Dave Jiang <dave.jiang@xxxxxxxxx>


> ---
> Changelog:
> 
> v2 -> v3:
>     - New patch.
> 
>  drivers/cxl/core/features.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c
> index ed18ccb5e236..e52371f87300 100644
> --- a/drivers/cxl/core/features.c
> +++ b/drivers/cxl/core/features.c
> @@ -225,7 +225,7 @@ size_t cxl_get_feature(struct cxl_mailbox *cxl_mbox, const uuid_t *feat_uuid,
>  		       void *feat_out, size_t feat_out_size, u16 offset,
>  		       u16 *return_code)
>  {
> -	size_t data_to_rd_size, size_out;
> +	size_t data_to_rd_size;
>  	struct cxl_mbox_get_feat_in pi;
>  	struct cxl_mbox_cmd mbox_cmd;
>  	size_t data_rcvd_size = 0;
> @@ -237,7 +237,6 @@ size_t cxl_get_feature(struct cxl_mailbox *cxl_mbox, const uuid_t *feat_uuid,
>  	if (!feat_out || !feat_out_size)
>  		return 0;
>  
> -	size_out = min(feat_out_size, cxl_mbox->payload_size);
>  	uuid_copy(&pi.uuid, feat_uuid);
>  	pi.selection = selection;
>  	do {
> @@ -250,7 +249,7 @@ size_t cxl_get_feature(struct cxl_mailbox *cxl_mbox, const uuid_t *feat_uuid,
>  			.opcode = CXL_MBOX_OP_GET_FEATURE,
>  			.size_in = sizeof(pi),
>  			.payload_in = &pi,
> -			.size_out = size_out,
> +			.size_out = data_to_rd_size,
>  			.payload_out = feat_out + data_rcvd_size,
>  			.min_out = data_to_rd_size,
>  		};