All of lore.kernel.org
 help / color / mirror / Atom feed
From: Coly Li <colyli@suse.de>
To: Richard Palethorpe <rpalethorpe@suse.com>, linux-nvdimm@lists.01.org
Cc: linux-kernel@vger.kernel.org, Coly Li <colyli@suse.com>
Subject: Re: [PATCH v2] nvdimm: Avoid race between probe and reading device attributes
Date: Mon, 15 Jun 2020 16:36:17 +0800	[thread overview]
Message-ID: <f59b5b3f-0de8-0ca1-6b39-9e93c57b2903@suse.de> (raw)
In-Reply-To: <20200615074723.12163-1-rpalethorpe@suse.com>

On 2020/6/15 15:47, Richard Palethorpe wrote:
> It is possible to cause a division error and use-after-free by querying the
> nmem device before the driver data is fully initialised in nvdimm_probe. E.g
> by doing
> 
> (while true; do
>      cat /sys/bus/nd/devices/nmem*/available_slots 2>&1 > /dev/null
>  done) &
> 
> while true; do
>      for i in $(seq 0 4); do
> 	 echo nmem$i > /sys/bus/nd/drivers/nvdimm/bind
>      done
>      for i in $(seq 0 4); do
> 	 echo nmem$i > /sys/bus/nd/drivers/nvdimm/unbind
>      done
>  done
> 
> On 5.7-rc3 this causes:

[snipped]

> 
> This can be prevented by setting the driver data after initialisation is
> complete.
> 
> Fixes: 4d88a97aa9e8 ("libnvdimm, nvdimm: dimm driver and base libnvdimm device-driver infrastructure")
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: Vishal Verma <vishal.l.verma@intel.com>
> Cc: Dave Jiang <dave.jiang@intel.com>
> Cc: Ira Weiny <ira.weiny@intel.com>
> Cc: linux-nvdimm@lists.01.org
> Cc: linux-kernel@vger.kernel.org
> Cc: Coly Li <colyli@suse.com>
> Signed-off-by: Richard Palethorpe <rpalethorpe@suse.com>


Reviewed-by: Coly Li <colyli@suse.de>

Thanks.

Coly Li

> ---
> 
> V2:
> + Reviewed by Coly and removed unecessary lock
> 
>  drivers/nvdimm/dimm.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/nvdimm/dimm.c b/drivers/nvdimm/dimm.c
> index 7d4ddc4d9322..3d3988e1d9a0 100644
> --- a/drivers/nvdimm/dimm.c
> +++ b/drivers/nvdimm/dimm.c
> @@ -43,7 +43,6 @@ static int nvdimm_probe(struct device *dev)
>  	if (!ndd)
>  		return -ENOMEM;
>  
> -	dev_set_drvdata(dev, ndd);
>  	ndd->dpa.name = dev_name(dev);
>  	ndd->ns_current = -1;
>  	ndd->ns_next = -1;
> @@ -106,6 +105,8 @@ static int nvdimm_probe(struct device *dev)
>  	if (rc)
>  		goto err;
>  
> +	dev_set_drvdata(dev, ndd);
> +
>  	return 0;
>  
>   err:
> 
_______________________________________________
Linux-nvdimm mailing list -- linux-nvdimm@lists.01.org
To unsubscribe send an email to linux-nvdimm-leave@lists.01.org

WARNING: multiple messages have this Message-ID (diff)
From: Coly Li <colyli@suse.de>
To: Richard Palethorpe <rpalethorpe@suse.com>, linux-nvdimm@lists.01.org
Cc: linux-kernel@vger.kernel.org, Coly Li <colyli@suse.com>
Subject: Re: [PATCH v2] nvdimm: Avoid race between probe and reading device attributes
Date: Mon, 15 Jun 2020 16:36:17 +0800	[thread overview]
Message-ID: <f59b5b3f-0de8-0ca1-6b39-9e93c57b2903@suse.de> (raw)
In-Reply-To: <20200615074723.12163-1-rpalethorpe@suse.com>

On 2020/6/15 15:47, Richard Palethorpe wrote:
> It is possible to cause a division error and use-after-free by querying the
> nmem device before the driver data is fully initialised in nvdimm_probe. E.g
> by doing
> 
> (while true; do
>      cat /sys/bus/nd/devices/nmem*/available_slots 2>&1 > /dev/null
>  done) &
> 
> while true; do
>      for i in $(seq 0 4); do
> 	 echo nmem$i > /sys/bus/nd/drivers/nvdimm/bind
>      done
>      for i in $(seq 0 4); do
> 	 echo nmem$i > /sys/bus/nd/drivers/nvdimm/unbind
>      done
>  done
> 
> On 5.7-rc3 this causes:

[snipped]

> 
> This can be prevented by setting the driver data after initialisation is
> complete.
> 
> Fixes: 4d88a97aa9e8 ("libnvdimm, nvdimm: dimm driver and base libnvdimm device-driver infrastructure")
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: Vishal Verma <vishal.l.verma@intel.com>
> Cc: Dave Jiang <dave.jiang@intel.com>
> Cc: Ira Weiny <ira.weiny@intel.com>
> Cc: linux-nvdimm@lists.01.org
> Cc: linux-kernel@vger.kernel.org
> Cc: Coly Li <colyli@suse.com>
> Signed-off-by: Richard Palethorpe <rpalethorpe@suse.com>


Reviewed-by: Coly Li <colyli@suse.de>

Thanks.

Coly Li

> ---
> 
> V2:
> + Reviewed by Coly and removed unecessary lock
> 
>  drivers/nvdimm/dimm.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/nvdimm/dimm.c b/drivers/nvdimm/dimm.c
> index 7d4ddc4d9322..3d3988e1d9a0 100644
> --- a/drivers/nvdimm/dimm.c
> +++ b/drivers/nvdimm/dimm.c
> @@ -43,7 +43,6 @@ static int nvdimm_probe(struct device *dev)
>  	if (!ndd)
>  		return -ENOMEM;
>  
> -	dev_set_drvdata(dev, ndd);
>  	ndd->dpa.name = dev_name(dev);
>  	ndd->ns_current = -1;
>  	ndd->ns_next = -1;
> @@ -106,6 +105,8 @@ static int nvdimm_probe(struct device *dev)
>  	if (rc)
>  		goto err;
>  
> +	dev_set_drvdata(dev, ndd);
> +
>  	return 0;
>  
>   err:
> 


  reply	other threads:[~2020-06-15  8:36 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-15  7:47 [PATCH v2] nvdimm: Avoid race between probe and reading device attributes Richard Palethorpe
2020-06-15  7:47 ` Richard Palethorpe
2020-06-15  8:36 ` Coly Li [this message]
2020-06-15  8:36   ` Coly Li
2021-01-07 10:54 ` Michal Suchánek
2021-01-07 10:54   ` Michal Suchánek
2021-02-01 23:19 ` Dan Williams
2021-02-01 23:19   ` Dan Williams
2021-02-02 16:58   ` Richard Palethorpe
2021-02-02 16:58     ` Richard Palethorpe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=f59b5b3f-0de8-0ca1-6b39-9e93c57b2903@suse.de \
    --to=colyli@suse.de \
    --cc=colyli@suse.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-nvdimm@lists.01.org \
    --cc=rpalethorpe@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.