Re: [PATCH] cxl/edac: Bounds-check ECS threshold index from device

[Dave Jiang]

On 9/28/26 12:35 AM, Yili Zhang wrote:
> cxl_get_ecs_threshold() extracts a 3-bit index (0-7) from the
> device-supplied ECS config word and uses it to
> index ecs_supp_threshold[], which only has 6 elements. A device reporting
> index 6 or 7 causes an out-of-bounds read of adjacent .rodata, whose
> value is then returned to userspace via the EDAC 'threshold' sysfs
> attribute (small info leak and wrong reported threshold).
> 
> Return 0 for indices outside the table.

Why return 0 instead of errno?

DJ

> 
> Fixes: 85fb6a16ad14 ("cxl/edac: Add CXL memory device ECS control feature")
> Signed-off-by: Yili Zhang <zhangyili01@xxxxxxxxx>
> ---
>  drivers/cxl/core/edac.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/cxl/core/edac.c b/drivers/cxl/core/edac.c
> index b321971fef58..73335b980b11 100644
> --- a/drivers/cxl/core/edac.c
> +++ b/drivers/cxl/core/edac.c
> @@ -633,6 +633,9 @@ static u16 cxl_get_ecs_threshold(u8 log_cap, u16 config)
>  {
>  	u8 index = FIELD_GET(CXL_ECS_THRESHOLD_COUNT_MASK, config);
>  
> +	if (index >= ARRAY_SIZE(ecs_supp_threshold))
> +		return 0;
> +
>  	return ecs_supp_threshold[index];
>  }
>