Re: [PATCH] cxl/edac: Bounds-check ECS threshold index from device

[Yili Zhang]

On 2026-09-28 11:21, Dave Jiang wrote:
>
> On 9/28/26 12:35 AM, Yili Zhang wrote:
> > cxl_get_ecs_threshold() extracts a 3-bit index (0-7) from the
> > device-supplied ECS config word and uses it to
> > index ecs_supp_threshold[], which only has 6 elements. A device reporting
> > index 6 or 7 causes an out-of-bounds read of adjacent .rodata, whose
> > value is then returned to userspace via the EDAC 'threshold' sysfs
> > attribute (small info leak and wrong reported threshold).
> >
> > Return 0 for indices outside the table.
>
> Why return 0 instead of errno?

The threshold count field is 3 bits wide, with encodings 0-2 and
6-7 reserved. ecs_supp_threshold[] is a sparse array that only
initializes entries 3-5 (256/1024/4096), so when a device reports
one of the reserved encodings 0-2, the current code already
returns 0. The patch just extends the same treatment to the
remaining reserved indices instead of reading past the table.
0 is also not a valid threshold value, so userspace can tell it
apart from a real one.

Returning an errno would additionally require open-coding a
separate getter for this one attribute, as it goes through the
shared CXL_ECS_GET_ATTR() macro, which cannot propagate errors.

So I'd prefer to keep returning 0 here.

Thanks,
Yili