* [PATCH] nvme-pci: Fix NULL ptr deref in EEH code
@ 2018-03-20 0:22 ` Michael Neuling
0 siblings, 0 replies; 4+ messages in thread
From: Michael Neuling @ 2018-03-20 0:22 UTC (permalink / raw)
To: Keith Busch
Cc: Jens Axboe, Christoph Hellwig, Sagi Grimberg, linux-nvme,
linux-kernel, mikey
On powerpc on boot we can take an EEH event which results in this oops.
cpu 0x23: Vector: 300 (Data Access) at [c000000ff50f3800]
pc: c0080000089a0eb0: nvme_error_detected+0x4c/0x90 [nvme]
lr: c000000000026564: eeh_report_error+0xe0/0x110
sp: c000000ff50f3a80
msr: 9000000000009033
dar: 400
dsisr: 40000000
current = 0xc000000ff507c000
paca = 0xc00000000fdc9d80 softe: 0 irq_happened: 0x01
pid = 782, comm = eehd
Linux version 4.15.6-openpower1 (smc@smc-desktop) (gcc version 6.4.0 (Buildroot 2017.11.2-00008-g4b6188e)) #2 SM P Tue Feb 27 12:33:27 PST 2018
enter ? for help
[c000000ff50f3af0] c000000000026564 eeh_report_error+0xe0/0x110
[c000000ff50f3b30] c000000000025520 eeh_pe_dev_traverse+0xc0/0xdc
[c000000ff50f3bc0] c000000000026bd0 eeh_handle_normal_event+0x184/0x4c4
[c000000ff50f3c70] c000000000026ff4 eeh_handle_event+0x30/0x288
[c000000ff50f3d10] c00000000002758c eeh_event_handler+0x124/0x170
[c000000ff50f3dc0] c00000000008fed0 kthread+0x14c/0x154
[c000000ff50f3e30] c00000000000b594 ret_from_kernel_thread+0x5c/0xc8
This fixes the NULL ptr deref.
Signed-off-by: Michael Neuling <mikey@neuling.org>
---
drivers/nvme/host/pci.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index b6f43b738f..404b346e3c 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2626,6 +2626,9 @@ static pci_ers_result_t nvme_error_detected(struct pci_dev *pdev,
{
struct nvme_dev *dev = pci_get_drvdata(pdev);
+ if (!dev)
+ return PCI_ERS_RESULT_NEED_RESET;
+
/*
* A frozen channel requires a reset. When detected, this method will
* shutdown the controller to quiesce. The controller will be restarted
--
2.14.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH] nvme-pci: Fix NULL ptr deref in EEH code
@ 2018-03-20 0:22 ` Michael Neuling
0 siblings, 0 replies; 4+ messages in thread
From: Michael Neuling @ 2018-03-20 0:22 UTC (permalink / raw)
On powerpc on boot we can take an EEH event which results in this oops.
cpu 0x23: Vector: 300 (Data Access) at [c000000ff50f3800]
pc: c0080000089a0eb0: nvme_error_detected+0x4c/0x90 [nvme]
lr: c000000000026564: eeh_report_error+0xe0/0x110
sp: c000000ff50f3a80
msr: 9000000000009033
dar: 400
dsisr: 40000000
current = 0xc000000ff507c000
paca = 0xc00000000fdc9d80 softe: 0 irq_happened: 0x01
pid = 782, comm = eehd
Linux version 4.15.6-openpower1 (smc at smc-desktop) (gcc version 6.4.0 (Buildroot 2017.11.2-00008-g4b6188e)) #2 SM P Tue Feb 27 12:33:27 PST 2018
enter ? for help
[c000000ff50f3af0] c000000000026564 eeh_report_error+0xe0/0x110
[c000000ff50f3b30] c000000000025520 eeh_pe_dev_traverse+0xc0/0xdc
[c000000ff50f3bc0] c000000000026bd0 eeh_handle_normal_event+0x184/0x4c4
[c000000ff50f3c70] c000000000026ff4 eeh_handle_event+0x30/0x288
[c000000ff50f3d10] c00000000002758c eeh_event_handler+0x124/0x170
[c000000ff50f3dc0] c00000000008fed0 kthread+0x14c/0x154
[c000000ff50f3e30] c00000000000b594 ret_from_kernel_thread+0x5c/0xc8
This fixes the NULL ptr deref.
Signed-off-by: Michael Neuling <mikey at neuling.org>
---
drivers/nvme/host/pci.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index b6f43b738f..404b346e3c 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2626,6 +2626,9 @@ static pci_ers_result_t nvme_error_detected(struct pci_dev *pdev,
{
struct nvme_dev *dev = pci_get_drvdata(pdev);
+ if (!dev)
+ return PCI_ERS_RESULT_NEED_RESET;
+
/*
* A frozen channel requires a reset. When detected, this method will
* shutdown the controller to quiesce. The controller will be restarted
--
2.14.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] nvme-pci: Fix NULL ptr deref in EEH code
2018-03-20 0:22 ` Michael Neuling
@ 2018-03-20 7:22 ` Christoph Hellwig
-1 siblings, 0 replies; 4+ messages in thread
From: Christoph Hellwig @ 2018-03-20 7:22 UTC (permalink / raw)
To: Michael Neuling
Cc: Keith Busch, Jens Axboe, Christoph Hellwig, Sagi Grimberg,
linux-nvme, linux-kernel, linux-pci
On Tue, Mar 20, 2018 at 11:22:42AM +1100, Michael Neuling wrote:
> diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
> index b6f43b738f..404b346e3c 100644
> --- a/drivers/nvme/host/pci.c
> +++ b/drivers/nvme/host/pci.c
> @@ -2626,6 +2626,9 @@ static pci_ers_result_t nvme_error_detected(struct pci_dev *pdev,
> {
> struct nvme_dev *dev = pci_get_drvdata(pdev);
>
> + if (!dev)
> + return PCI_ERS_RESULT_NEED_RESET;
This implies the method has been called before ->probe has been finished
or after ->remove has been called. That would be fundamentally racy
and needs to be fixed in the PCI layer, not papered over in drivers.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] nvme-pci: Fix NULL ptr deref in EEH code
@ 2018-03-20 7:22 ` Christoph Hellwig
0 siblings, 0 replies; 4+ messages in thread
From: Christoph Hellwig @ 2018-03-20 7:22 UTC (permalink / raw)
On Tue, Mar 20, 2018@11:22:42AM +1100, Michael Neuling wrote:
> diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
> index b6f43b738f..404b346e3c 100644
> --- a/drivers/nvme/host/pci.c
> +++ b/drivers/nvme/host/pci.c
> @@ -2626,6 +2626,9 @@ static pci_ers_result_t nvme_error_detected(struct pci_dev *pdev,
> {
> struct nvme_dev *dev = pci_get_drvdata(pdev);
>
> + if (!dev)
> + return PCI_ERS_RESULT_NEED_RESET;
This implies the method has been called before ->probe has been finished
or after ->remove has been called. That would be fundamentally racy
and needs to be fixed in the PCI layer, not papered over in drivers.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-03-20 7:22 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-20 0:22 [PATCH] nvme-pci: Fix NULL ptr deref in EEH code Michael Neuling
2018-03-20 0:22 ` Michael Neuling
2018-03-20 7:22 ` Christoph Hellwig
2018-03-20 7:22 ` Christoph Hellwig
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.