On Sun, 13 Apr 2025, Ira Weiny wrote:

+static int cxlr_add_extent(struct cxl_dax_region *cxlr_dax,
+                          struct cxl_endpoint_decoder *cxled,
+                          struct cxled_extent *ed_extent)
+{
+       struct region_extent *region_extent;
+       struct range hpa_range;
+       int rc;
+
+       calc_hpa_range(cxled, cxlr_dax, &ed_extent->dpa_range, &hpa_range);
+
+       region_extent = alloc_region_extent(cxlr_dax, &hpa_range, 
&ed_extent->uuid);
+       if (IS_ERR(region_extent))
+               return PTR_ERR(region_extent);
+

afaict the ed_extent can leak in this error path

+       rc = xa_insert(&region_extent->decoder_extents, (unsigned 
long)ed_extent,
+                      ed_extent, GFP_KERNEL);
+       if (rc) {
+               free_region_extent(region_extent);
+               return rc;
+       }

.. and this one (not in the xarray).

+
+       /* device model handles freeing region_extent */
+       return online_region_extent(region_extent);
+}

...

static void cxl_mem_get_records_log(struct cxl_memdev_state *mds,
                                    enum cxl_event_log_type type)
{
@@ -1100,9 +1369,13 @@ static void cxl_mem_get_records_log(struct 
cxl_memdev_state *mds,
                if (!nr_rec)
                        break;

-               for (i = 0; i < nr_rec; i++)
+               for (i = 0; i < nr_rec; i++) {
                        __cxl_event_trace_record(cxlmd, type,
                                                 &payload->records[i]);
+                       if (type == CXL_EVENT_TYPE_DCD)
+                               cxl_handle_dcd_event_records(mds,
+                                                       &payload->records[i]);
+               }

                if (payload->flags & CXL_GET_EVENT_FLAG_OVERFLOW)
                        trace_cxl_overflow(cxlmd, type, payload);

With DCD the extent list needs resync'd in the overflow case; 
cxl_process_extent_list() needs
called.

Reply via email to