[PATCH] Fix NULL pointer deref in nvme_ctrl_fast_io_fail_tmo_show

[PATCH] Fix NULL pointer deref in nvme_ctrl_fast_io_fail_tmo_show

[Gopal Tiwari]

When accessing fast_io_fail_tmo from /sys hit kernel crash

 #7 [ffff9ddf82467d80] page_fault at ffffffff90e010fe
    [exception RIP: nvme_ctrl_fast_io_fail_tmo_show+22]
    RIP: ffffffffc0465116  RSP: ffff9ddf82467e38  RFLAGS: 00010286
    RAX: 0000000000000000  RBX: ffffffffc0476260  RCX: ffff8b617fe94000
    RDX: ffff8b617fe94000  RSI: ffffffffc0476260  RDI: ffff8b5e45a303a8
    RBP: ffffffff912b7d30   R8: ffff8b5e45a303b8   R9: ffff8b618dae5900
    R10: ffff8b617fe94000  R11: 0000000000000001  R12: 00000000ffffffff
    R13: 0000000000000001  R14: ffff8b617f46ee00  R15: ffff8b60e9a56380
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #8 [ffff9ddf82467e30] mutex_lock at ffffffff90d4a5ce
 #9 [ffff9ddf82467e50] sysfs_kf_seq_show at ffffffff907b0abb

Fixed by the checking opts for NULL.

Fixes: 09fbed636382 (nvme: export fast_io_fail_tmo to sysfs)
Signed-off-by: Gopal Tiwari <gtiwari@redhat.com>
---
 drivers/nvme/host/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 314705da2c10..39b8fbe87adb 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3752,7 +3752,7 @@ static ssize_t nvme_ctrl_fast_io_fail_tmo_show(struct device *dev,
 {
 	struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
 
-	if (ctrl->opts->fast_io_fail_tmo == -1)
+	if (!ctrl->opts || ctrl->opts->fast_io_fail_tmo == -1)
 		return sysfs_emit(buf, "off\n");
 	return sysfs_emit(buf, "%d\n", ctrl->opts->fast_io_fail_tmo);
 }
-- 
2.26.2


_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme

Re: [PATCH] Fix NULL pointer deref in nvme_ctrl_fast_io_fail_tmo_show

[Daniel Wagner]

On Tue, Apr 13, 2021 at 12:19:53PM +0530, Gopal Tiwari wrote:
> When accessing fast_io_fail_tmo from /sys hit kernel crash
> 
>  #7 [ffff9ddf82467d80] page_fault at ffffffff90e010fe
>     [exception RIP: nvme_ctrl_fast_io_fail_tmo_show+22]
>     RIP: ffffffffc0465116  RSP: ffff9ddf82467e38  RFLAGS: 00010286
>     RAX: 0000000000000000  RBX: ffffffffc0476260  RCX: ffff8b617fe94000
>     RDX: ffff8b617fe94000  RSI: ffffffffc0476260  RDI: ffff8b5e45a303a8
>     RBP: ffffffff912b7d30   R8: ffff8b5e45a303b8   R9: ffff8b618dae5900
>     R10: ffff8b617fe94000  R11: 0000000000000001  R12: 00000000ffffffff
>     R13: 0000000000000001  R14: ffff8b617f46ee00  R15: ffff8b60e9a56380
>     ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
>  #8 [ffff9ddf82467e30] mutex_lock at ffffffff90d4a5ce
>  #9 [ffff9ddf82467e50] sysfs_kf_seq_show at ffffffff907b0abb
> 
> Fixed by the checking opts for NULL.
> 
> Fixes: 09fbed636382 (nvme: export fast_io_fail_tmo to sysfs)
> Signed-off-by: Gopal Tiwari <gtiwari@redhat.com>

Do the other functions like nvme_ctrl_loss_tmo_*(),
nvme_sysfs_show_address(), ... not also need this treatment?

_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme