* [PATCH] cxl: Check if afu is not null in cxl_slbia
@ 2015-07-09 23:04 Daniel Axtens
2015-07-09 23:50 ` Michael Neuling
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Daniel Axtens @ 2015-07-09 23:04 UTC (permalink / raw)
To: linuxppc-dev; +Cc: mpe, benh, mikey, imunsie, Daniel Axtens
The pointer to an AFU in the adapter's list of AFUs can be null
if we're in the process of removing AFUs. The afu_list_lock
doesn't guard against this.
Say we have 2 slices, and we're in the process of removing cxl.
- We remove the AFUs in order (see cxl_remove). In cxl_remove_afu
for AFU 0, we take the lock, set adapter->afu[0] = NULL, and
release the lock.
- Then we get an slbia. In cxl_slbia we take the lock, and set
afu = adapter->afu[0], which is NULL.
- Therefore our attempt to check afu->enabled will blow up.
Therefore, check if afu is a null pointer before dereferencing it.
cc: STABLE
Signed-off-by: Daniel Axtens <dja@axtens.net>
---
drivers/misc/cxl/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
index 11a2044d6b0f..5bcd676bfd59 100644
--- a/drivers/misc/cxl/main.c
+++ b/drivers/misc/cxl/main.c
@@ -86,7 +86,7 @@ static inline void cxl_slbia_core(struct mm_struct *mm)
spin_lock(&adapter->afu_list_lock);
for (slice = 0; slice < adapter->slices; slice++) {
afu = adapter->afu[slice];
- if (!afu->enabled)
+ if (!afu || !afu->enabled)
continue;
rcu_read_lock();
idr_for_each_entry(&afu->contexts_idr, ctx, id)
--
2.1.4
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] cxl: Check if afu is not null in cxl_slbia
2015-07-09 23:04 [PATCH] cxl: Check if afu is not null in cxl_slbia Daniel Axtens
@ 2015-07-09 23:50 ` Michael Neuling
2015-07-10 0:09 ` Ian Munsie
2015-07-10 6:55 ` Michael Ellerman
2 siblings, 0 replies; 4+ messages in thread
From: Michael Neuling @ 2015-07-09 23:50 UTC (permalink / raw)
To: Daniel Axtens; +Cc: linuxppc-dev, mpe, benh, imunsie
On Fri, 2015-07-10 at 09:04 +1000, Daniel Axtens wrote:
> The pointer to an AFU in the adapter's list of AFUs can be null
> if we're in the process of removing AFUs. The afu_list_lock
> doesn't guard against this.
>=20
> Say we have 2 slices, and we're in the process of removing cxl.
> - We remove the AFUs in order (see cxl_remove). In cxl_remove_afu
> for AFU 0, we take the lock, set adapter->afu[0] =3D NULL, and
> release the lock.
> - Then we get an slbia. In cxl_slbia we take the lock, and set
> afu =3D adapter->afu[0], which is NULL.
> - Therefore our attempt to check afu->enabled will blow up.
>=20
> Therefore, check if afu is a null pointer before dereferencing it.
>=20
> cc: STABLE
FYI This needs to be (see Documentation/stable_kernel_rules.txt):
Cc: stable@vger.kernel.org
Other than that, looks good. Thanks.
Acked-by: Michael Neuling <mikey@neuling.org>
> Signed-off-by: Daniel Axtens <dja@axtens.net>
> ---
> drivers/misc/cxl/main.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>=20
> diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
> index 11a2044d6b0f..5bcd676bfd59 100644
> --- a/drivers/misc/cxl/main.c
> +++ b/drivers/misc/cxl/main.c
> @@ -86,7 +86,7 @@ static inline void cxl_slbia_core(struct mm_struct *mm)
> spin_lock(&adapter->afu_list_lock);
> for (slice =3D 0; slice < adapter->slices; slice++) {
> afu =3D adapter->afu[slice];
> - if (!afu->enabled)
> + if (!afu || !afu->enabled)
> continue;
> rcu_read_lock();
> idr_for_each_entry(&afu->contexts_idr, ctx, id)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] cxl: Check if afu is not null in cxl_slbia
2015-07-09 23:04 [PATCH] cxl: Check if afu is not null in cxl_slbia Daniel Axtens
2015-07-09 23:50 ` Michael Neuling
@ 2015-07-10 0:09 ` Ian Munsie
2015-07-10 6:55 ` Michael Ellerman
2 siblings, 0 replies; 4+ messages in thread
From: Ian Munsie @ 2015-07-10 0:09 UTC (permalink / raw)
To: Daniel Axtens; +Cc: linuxppc-dev, mikey
Acked-by: Ian Munsie <imunsie@au1.ibm.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: cxl: Check if afu is not null in cxl_slbia
2015-07-09 23:04 [PATCH] cxl: Check if afu is not null in cxl_slbia Daniel Axtens
2015-07-09 23:50 ` Michael Neuling
2015-07-10 0:09 ` Ian Munsie
@ 2015-07-10 6:55 ` Michael Ellerman
2 siblings, 0 replies; 4+ messages in thread
From: Michael Ellerman @ 2015-07-10 6:55 UTC (permalink / raw)
To: Daniel Axtens, linuxppc-dev; +Cc: mikey, Daniel Axtens, imunsie
On Thu, 2015-09-07 at 23:04:25 UTC, Daniel Axtens wrote:
> The pointer to an AFU in the adapter's list of AFUs can be null
> if we're in the process of removing AFUs. The afu_list_lock
> doesn't guard against this.
>
> Say we have 2 slices, and we're in the process of removing cxl.
> - We remove the AFUs in order (see cxl_remove). In cxl_remove_afu
> for AFU 0, we take the lock, set adapter->afu[0] = NULL, and
> release the lock.
> - Then we get an slbia. In cxl_slbia we take the lock, and set
> afu = adapter->afu[0], which is NULL.
> - Therefore our attempt to check afu->enabled will blow up.
>
> Therefore, check if afu is a null pointer before dereferencing it.
>
Cc: stable@vger.kernel.org
> Signed-off-by: Daniel Axtens <dja@axtens.net>
> Acked-by: Michael Neuling <mikey@neuling.org>
> Acked-by: Ian Munsie <imunsie@au1.ibm.com>
Applied to powerpc fixes, thanks.
https://git.kernel.org/powerpc/c/2c069a118fe1d80c47dc
cheers
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-07-10 6:55 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-07-09 23:04 [PATCH] cxl: Check if afu is not null in cxl_slbia Daniel Axtens
2015-07-09 23:50 ` Michael Neuling
2015-07-10 0:09 ` Ian Munsie
2015-07-10 6:55 ` Michael Ellerman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).