diff mbox

libnvdimm: fix NULL ptr access in nvdimm_flush when region is disabled

Message ID 152339295872.17800.11928214580818704332.stgit@djiang5-desk3.ch.intel.com (mailing list archive)
State New, archived
Headers show

Commit Message

Dave Jiang April 10, 2018, 8:42 p.m. UTC
When a region is disabled, there is no driver attached. Therefore
dev->driverdata is NULL. An attempt to write to regionN/deep_flush via sysfs
would cause a NULL pointer dereference. Bail when dev->driver is NULL to
protect this scenario.

Fix: ab630891ce0eb(libnvdimm, region: sysfs trigger for nvdimm_flush())

Signed-off-by: Dave Jiang <dave.jiang@intel.com>
---
 drivers/nvdimm/region_devs.c |    4 ++++
 1 file changed, 4 insertions(+)

Comments

Dan Williams April 10, 2018, 8:46 p.m. UTC | #1
On Tue, Apr 10, 2018 at 1:42 PM, Dave Jiang <dave.jiang@intel.com> wrote:
> When a region is disabled, there is no driver attached. Therefore
> dev->driverdata is NULL. An attempt to write to regionN/deep_flush via sysfs
> would cause a NULL pointer dereference. Bail when dev->driver is NULL to
> protect this scenario.
>
> Fix: ab630891ce0eb(libnvdimm, region: sysfs trigger for nvdimm_flush())
>
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> ---
>  drivers/nvdimm/region_devs.c |    4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
> index a612be6f019d..d5619b7feb6a 100644
> --- a/drivers/nvdimm/region_devs.c
> +++ b/drivers/nvdimm/region_devs.c
> @@ -1074,6 +1074,10 @@ void nvdimm_flush(struct nd_region *nd_region)
>         struct nd_region_data *ndrd = dev_get_drvdata(&nd_region->dev);
>         int i, idx;
>
> +       /* protect against disabled region */
> +       if (!nd_region->dev.driver)
> +               return;
> +

Move this to deep_flush_store(). That's the only caller that can
trigger nvdimm_flush() while the region might be disabled, and that
needs to return an error code.
diff mbox

Patch

diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index a612be6f019d..d5619b7feb6a 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -1074,6 +1074,10 @@  void nvdimm_flush(struct nd_region *nd_region)
 	struct nd_region_data *ndrd = dev_get_drvdata(&nd_region->dev);
 	int i, idx;
 
+	/* protect against disabled region */
+	if (!nd_region->dev.driver)
+		return;
+
 	/*
 	 * Try to encourage some diversity in flush hint addresses
 	 * across cpus assuming a limited number of flush hints.