mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
![]() Richard reports that the following test:
(while true; do
cat /sys/bus/nd/devices/nmem*/available_slots 2>&1 > /dev/null
done) &
while true; do
for i in $(seq 0 4); do
echo nmem$i > /sys/bus/nd/drivers/nvdimm/bind
done
for i in $(seq 0 4); do
echo nmem$i > /sys/bus/nd/drivers/nvdimm/unbind
done
done
...fails with a crash signature like:
divide error: 0000 [#1] SMP KASAN PTI
RIP: 0010:nd_label_nfree+0x134/0x1a0 [libnvdimm]
[..]
Call Trace:
available_slots_show+0x4e/0x120 [libnvdimm]
dev_attr_show+0x42/0x80
? memset+0x20/0x40
sysfs_kf_seq_show+0x218/0x410
The root cause is that available_slots_show() consults driver-data, but
fails to synchronize against device-unbind setting up a TOCTOU race to
access uninitialized memory.
Validate driver-data under the device-lock.
Fixes:
|
||
---|---|---|
.. | ||
badrange.c | ||
blk.c | ||
btt.c | ||
btt.h | ||
btt_devs.c | ||
bus.c | ||
claim.c | ||
core.c | ||
dax_devs.c | ||
dimm.c | ||
dimm_devs.c | ||
e820.c | ||
Kconfig | ||
label.c | ||
label.h | ||
Makefile | ||
namespace_devs.c | ||
nd-core.h | ||
nd.h | ||
nd_virtio.c | ||
of_pmem.c | ||
pfn.h | ||
pfn_devs.c | ||
pmem.c | ||
pmem.h | ||
region.c | ||
region_devs.c | ||
security.c | ||
virtio_pmem.c | ||
virtio_pmem.h |