linux-kernel - Re: [PATCH] libnvdimm, pmem: fix badblocks notification crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 27 Apr 2017 22:25:07 +0000
From:   "Kani, Toshimitsu" <toshi.kani@....com>
To:     "dan.j.williams@...el.com" <dan.j.williams@...el.com>,
        "linux-nvdimm@...ts.01.org" <linux-nvdimm@...ts.01.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>,
        "vishal.l.verma@...el.com" <vishal.l.verma@...el.com>
Subject: Re: [PATCH] libnvdimm, pmem: fix badblocks notification crash

On Thu, 2017-04-27 at 15:10 -0700, Dan Williams wrote:
> The nd_pmem_notify() routine is called whenever an ARS
> (address-range-scrub) completes to communicate results to the
> per-namespace badblocks instances.
> 
> When the namespace is in btt mode we crash because we do not allocate
> a struct pmem_device instance in that case. Resulting in the
> following crash signature:
> 
>  BUG: unable to handle kernel NULL pointer dereference at
> 0000000000000030
>  IP: nd_pmem_notify+0x30/0xf0 [nd_pmem]
>  Call Trace:
>   nd_device_notify+0x40/0x50
>   child_notify+0x10/0x20
>   device_for_each_child+0x50/0x90
>   nd_region_notify+0x20/0x30
>   nd_device_notify+0x40/0x50
>   nvdimm_region_notify+0x27/0x30
>   acpi_nfit_scrub+0x341/0x590 [nfit]
>   process_one_work+0x197/0x450
>   worker_thread+0x4e/0x4a0
>   kthread+0x109/0x140
> 
> Given that we don't even populate the btt badblocks instance, just
> return early and skip the device to region lookup.

We populate the btt badblocks into nsio->bb, and check/clear them in
nsio_rw_bytes().

Thanks,
-Toshi