[PATCH] cxl/edac: Bounds-check ECS threshold index from device

[PATCH] cxl/edac: Bounds-check ECS threshold index from device

[Yili Zhang]

cxl_get_ecs_threshold() extracts a 3-bit index (0-7) from the
device-supplied ECS config word and uses it to
index ecs_supp_threshold[], which only has 6 elements. A device reporting
index 6 or 7 causes an out-of-bounds read of adjacent .rodata, whose
value is then returned to userspace via the EDAC 'threshold' sysfs
attribute (small info leak and wrong reported threshold).

Return 0 for indices outside the table.

Fixes: 85fb6a16ad14 ("cxl/edac: Add CXL memory device ECS control feature")
Signed-off-by: Yili Zhang <zhangyili01@baidu.com>
---
 drivers/cxl/core/edac.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/cxl/core/edac.c b/drivers/cxl/core/edac.c
index b321971fef58..73335b980b11 100644
--- a/drivers/cxl/core/edac.c
+++ b/drivers/cxl/core/edac.c
@@ -633,6 +633,9 @@ static u16 cxl_get_ecs_threshold(u8 log_cap, u16 config)
 {
 	u8 index = FIELD_GET(CXL_ECS_THRESHOLD_COUNT_MASK, config);
 
+	if (index >= ARRAY_SIZE(ecs_supp_threshold))
+		return 0;
+
 	return ecs_supp_threshold[index];
 }
 
-- 
2.27.0

Re: [PATCH] cxl/edac: Bounds-check ECS threshold index from device

[Dave Jiang]

On 9/28/26 12:35 AM, Yili Zhang wrote:
> cxl_get_ecs_threshold() extracts a 3-bit index (0-7) from the
> device-supplied ECS config word and uses it to
> index ecs_supp_threshold[], which only has 6 elements. A device reporting
> index 6 or 7 causes an out-of-bounds read of adjacent .rodata, whose
> value is then returned to userspace via the EDAC 'threshold' sysfs
> attribute (small info leak and wrong reported threshold).
> 
> Return 0 for indices outside the table.

Why return 0 instead of errno?

DJ

> 
> Fixes: 85fb6a16ad14 ("cxl/edac: Add CXL memory device ECS control feature")
> Signed-off-by: Yili Zhang <zhangyili01@baidu.com>
> ---
>  drivers/cxl/core/edac.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/cxl/core/edac.c b/drivers/cxl/core/edac.c
> index b321971fef58..73335b980b11 100644
> --- a/drivers/cxl/core/edac.c
> +++ b/drivers/cxl/core/edac.c
> @@ -633,6 +633,9 @@ static u16 cxl_get_ecs_threshold(u8 log_cap, u16 config)
>  {
>  	u8 index = FIELD_GET(CXL_ECS_THRESHOLD_COUNT_MASK, config);
>  
> +	if (index >= ARRAY_SIZE(ecs_supp_threshold))
> +		return 0;
> +
>  	return ecs_supp_threshold[index];
>  }
>  

Re: [PATCH] cxl/edac: Bounds-check ECS threshold index from device

[Yili Zhang]

On 2026-09-28 11:21, Dave Jiang wrote:
>
> On 9/28/26 12:35 AM, Yili Zhang wrote:
> > cxl_get_ecs_threshold() extracts a 3-bit index (0-7) from the
> > device-supplied ECS config word and uses it to
> > index ecs_supp_threshold[], which only has 6 elements. A device reporting
> > index 6 or 7 causes an out-of-bounds read of adjacent .rodata, whose
> > value is then returned to userspace via the EDAC 'threshold' sysfs
> > attribute (small info leak and wrong reported threshold).
> >
> > Return 0 for indices outside the table.
>
> Why return 0 instead of errno?

The threshold count field is 3 bits wide, with encodings 0-2 and
6-7 reserved. ecs_supp_threshold[] is a sparse array that only
initializes entries 3-5 (256/1024/4096), so when a device reports
one of the reserved encodings 0-2, the current code already
returns 0. The patch just extends the same treatment to the
remaining reserved indices instead of reading past the table.
0 is also not a valid threshold value, so userspace can tell it
apart from a real one.

Returning an errno would additionally require open-coding a
separate getter for this one attribute, as it goes through the
shared CXL_ECS_GET_ATTR() macro, which cannot propagate errors.

So I'd prefer to keep returning 0 here.

Thanks,
Yili