mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-28 15:20:41 +00:00
cxl: Check if afu is not null in cxl_slbia
The pointer to an AFU in the adapter's list of AFUs can be null if we're in the process of removing AFUs. The afu_list_lock doesn't guard against this. Say we have 2 slices, and we're in the process of removing cxl. - We remove the AFUs in order (see cxl_remove). In cxl_remove_afu for AFU 0, we take the lock, set adapter->afu[0] = NULL, and release the lock. - Then we get an slbia. In cxl_slbia we take the lock, and set afu = adapter->afu[0], which is NULL. - Therefore our attempt to check afu->enabled will blow up. Therefore, check if afu is a null pointer before dereferencing it. Cc: stable@vger.kernel.org Signed-off-by: Daniel Axtens <dja@axtens.net> Acked-by: Michael Neuling <mikey@neuling.org> Acked-by: Ian Munsie <imunsie@au1.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
This commit is contained in:
parent
9958084a52
commit
2c069a118f
1 changed files with 1 additions and 1 deletions
|
@ -73,7 +73,7 @@ static inline void cxl_slbia_core(struct mm_struct *mm)
|
||||||
spin_lock(&adapter->afu_list_lock);
|
spin_lock(&adapter->afu_list_lock);
|
||||||
for (slice = 0; slice < adapter->slices; slice++) {
|
for (slice = 0; slice < adapter->slices; slice++) {
|
||||||
afu = adapter->afu[slice];
|
afu = adapter->afu[slice];
|
||||||
if (!afu->enabled)
|
if (!afu || !afu->enabled)
|
||||||
continue;
|
continue;
|
||||||
rcu_read_lock();
|
rcu_read_lock();
|
||||||
idr_for_each_entry(&afu->contexts_idr, ctx, id)
|
idr_for_each_entry(&afu->contexts_idr, ctx, id)
|
||||||
|
|
Loading…
Reference in a new issue