[PATCH] cxl/region: Reject delete of a provider-locked region

[Richard Cheng <icheng@nvidia.com>]

delete_region_store() destroys a region object without checking
CXL_REGION_F_LOCK, unlike commit_store() which refuses locked regions
with -EPERM. A region owned by a memdev-attach provider carries F_LOCK,
and cxl_region_decode_reset() deliberately skips the HDM decoder reset
for F_LOCK regions. As a result, a userspace write to delete_region
tears down the region object but leaves the endpoint HDM decoder
committed with no owning region, which is an orphan, enabled decoder.

Gate delete_region_store() on CXL_REGION_F_LOCK.

Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/region.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 578622240401..cfc9622c9309 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2894,6 +2894,9 @@ static ssize_t delete_region_store(struct device *dev,
 	if (!cxlr || !sysfs_streq(buf, dev_name(&cxlr->dev)))
 		return -ENODEV;
 
+	if (test_bit(CXL_REGION_F_LOCK, &cxlr->flags))
+		return -EPERM;
+
 	unregister_region(cxlr);
 
 	return len;

base-commit: 5ca04f3ba91f1773bbd5da6d9c654ccc1ba7831d
-- 
2.43.0