Patch "libnvdimm, region: fix flush hint detection crash" has been added to the 4.10-stable tree

Patch "libnvdimm, region: fix flush hint detection crash" has been added to the 4.10-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    libnvdimm, region: fix flush hint detection crash

to the 4.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     libnvdimm-region-fix-flush-hint-detection-crash.patch
and it can be found in the queue-4.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From bc042fdfbb92b5b13421316b4548e2d6e98eed37 Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Mon, 24 Apr 2017 15:43:05 -0700
Subject: libnvdimm, region: fix flush hint detection crash

From: Dan Williams <dan.j.williams@intel.com>

commit bc042fdfbb92b5b13421316b4548e2d6e98eed37 upstream.

In the case where a dimm does not have any associated flush hints the
ndrd->flush_wpq array may be uninitialized leading to crashes with the
following signature:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
 IP: region_visible+0x10f/0x160 [libnvdimm]

 Call Trace:
  internal_create_group+0xbe/0x2f0
  sysfs_create_groups+0x40/0x80
  device_add+0x2d8/0x650
  nd_async_device_register+0x12/0x40 [libnvdimm]
  async_run_entry_fn+0x39/0x170
  process_one_work+0x212/0x6c0
  ? process_one_work+0x197/0x6c0
  worker_thread+0x4e/0x4a0
  kthread+0x10c/0x140
  ? process_one_work+0x6c0/0x6c0
  ? kthread_create_on_node+0x60/0x60
  ret_from_fork+0x31/0x40

Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Fixes: f284a4f23752 ("libnvdimm: introduce nvdimm_flush() and nvdimm_has_flush()")
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/nvdimm/region_devs.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -968,17 +968,20 @@ EXPORT_SYMBOL_GPL(nvdimm_flush);
  */
 int nvdimm_has_flush(struct nd_region *nd_region)
 {
-	struct nd_region_data *ndrd = dev_get_drvdata(&nd_region->dev);
 	int i;
 
 	/* no nvdimm == flushing capability unknown */
 	if (nd_region->ndr_mappings == 0)
 		return -ENXIO;
 
-	for (i = 0; i < nd_region->ndr_mappings; i++)
-		/* flush hints present, flushing required */
-		if (ndrd_get_flush_wpq(ndrd, i, 0))
+	for (i = 0; i < nd_region->ndr_mappings; i++) {
+		struct nd_mapping *nd_mapping = &nd_region->mapping[i];
+		struct nvdimm *nvdimm = nd_mapping->nvdimm;
+
+		/* flush hints present / available */
+		if (nvdimm->num_flush)
 			return 1;
+	}
 
 	/*
 	 * The platform defines dimm devices without hints, assume


Patches currently in stable-queue which might be from dan.j.williams@intel.com are

queue-4.10/libnvdimm-fix-nvdimm_bus_lock-vs-device_lock-ordering.patch
queue-4.10/x86-pmem-fix-cache-flushing-for-iovec-write-8-bytes.patch
queue-4.10/dax-prevent-invalidation-of-mapped-dax-entries.patch
queue-4.10/libnvdimm-region-fix-flush-hint-detection-crash.patch
queue-4.10/libnvdimm-pfn-fix-npfns-vs-section-alignment.patch
queue-4.10/libnvdimm-pmem-fix-a-null-pointer-bug-in-nd_pmem_notify.patch
queue-4.10/device-dax-fix-cdev-leak.patch
queue-4.10/device-dax-fix-sysfs-attribute-deadlock.patch
queue-4.10/mm-fix-data-corruption-due-to-stale-mmap-reads.patch