mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
7018c897c2
Richard reports that the following test:
(while true; do
cat /sys/bus/nd/devices/nmem*/available_slots 2>&1 > /dev/null
done) &
while true; do
for i in $(seq 0 4); do
echo nmem$i > /sys/bus/nd/drivers/nvdimm/bind
done
for i in $(seq 0 4); do
echo nmem$i > /sys/bus/nd/drivers/nvdimm/unbind
done
done
...fails with a crash signature like:
divide error: 0000 [#1] SMP KASAN PTI
RIP: 0010:nd_label_nfree+0x134/0x1a0 [libnvdimm]
[..]
Call Trace:
available_slots_show+0x4e/0x120 [libnvdimm]
dev_attr_show+0x42/0x80
? memset+0x20/0x40
sysfs_kf_seq_show+0x218/0x410
The root cause is that available_slots_show() consults driver-data, but
fails to synchronize against device-unbind setting up a TOCTOU race to
access uninitialized memory.
Validate driver-data under the device-lock.
Fixes:
|
||
|---|---|---|
| .. | ||
| badrange.c | ||
| blk.c | ||
| btt.c | ||
| btt.h | ||
| btt_devs.c | ||
| bus.c | ||
| claim.c | ||
| core.c | ||
| dax_devs.c | ||
| dimm.c | ||
| dimm_devs.c | ||
| e820.c | ||
| Kconfig | ||
| label.c | ||
| label.h | ||
| Makefile | ||
| namespace_devs.c | ||
| nd-core.h | ||
| nd.h | ||
| nd_virtio.c | ||
| of_pmem.c | ||
| pfn.h | ||
| pfn_devs.c | ||
| pmem.c | ||
| pmem.h | ||
| region.c | ||
| region_devs.c | ||
| security.c | ||
| virtio_pmem.c | ||
| virtio_pmem.h | ||