[PATCH] libnvdimm: fix NULL ptr access in nvdimm_flush when region is disabled

[PATCH] libnvdimm: fix NULL ptr access in nvdimm_flush when region is disabled

[Dave Jiang]

When a region is disabled, there is no driver attached. Therefore
dev->driverdata is NULL. An attempt to write to regionN/deep_flush via sysfs
would cause a NULL pointer dereference. Bail when dev->driver is NULL to
protect this scenario.

Fix: ab630891ce0eb(libnvdimm, region: sysfs trigger for nvdimm_flush())

Signed-off-by: Dave Jiang <dave.jiang@intel.com>
---
 drivers/nvdimm/region_devs.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index a612be6f019d..d5619b7feb6a 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -1074,6 +1074,10 @@ void nvdimm_flush(struct nd_region *nd_region)
 	struct nd_region_data *ndrd = dev_get_drvdata(&nd_region->dev);
 	int i, idx;
 
+	/* protect against disabled region */
+	if (!nd_region->dev.driver)
+		return;
+
 	/*
 	 * Try to encourage some diversity in flush hint addresses
 	 * across cpus assuming a limited number of flush hints.

_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm

Re: [PATCH] libnvdimm: fix NULL ptr access in nvdimm_flush when region is disabled

[Dan Williams]

On Tue, Apr 10, 2018 at 1:42 PM, Dave Jiang <dave.jiang@intel.com> wrote:
> When a region is disabled, there is no driver attached. Therefore
> dev->driverdata is NULL. An attempt to write to regionN/deep_flush via sysfs
> would cause a NULL pointer dereference. Bail when dev->driver is NULL to
> protect this scenario.
>
> Fix: ab630891ce0eb(libnvdimm, region: sysfs trigger for nvdimm_flush())
>
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> ---
>  drivers/nvdimm/region_devs.c |    4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
> index a612be6f019d..d5619b7feb6a 100644
> --- a/drivers/nvdimm/region_devs.c
> +++ b/drivers/nvdimm/region_devs.c
> @@ -1074,6 +1074,10 @@ void nvdimm_flush(struct nd_region *nd_region)
>         struct nd_region_data *ndrd = dev_get_drvdata(&nd_region->dev);
>         int i, idx;
>
> +       /* protect against disabled region */
> +       if (!nd_region->dev.driver)
> +               return;
> +

Move this to deep_flush_store(). That's the only caller that can
trigger nvdimm_flush() while the region might be disabled, and that
needs to return an error code.
_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm