linux-kernel - Re: [PATCH] libnvdimm, pmem: fix badblocks notification crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 27 Apr 2017 22:28:08 +0000
From:   "Kani, Toshimitsu" <toshi.kani@....com>
To:     "dan.j.williams@...el.com" <dan.j.williams@...el.com>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-nvdimm@...ts.01.org" <linux-nvdimm@...ts.01.org>,
        "linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>,
        "vishal.l.verma@...el.com" <vishal.l.verma@...el.com>
Subject: Re: [PATCH] libnvdimm, pmem: fix badblocks notification crash

On Thu, 2017-04-27 at 15:26 -0700, Dan Williams wrote:
> On Thu, Apr 27, 2017 at 3:25 PM, Kani, Toshimitsu <toshi.kani@....com
> > wrote:
> > On Thu, 2017-04-27 at 15:10 -0700, Dan Williams wrote:
> > > The nd_pmem_notify() routine is called whenever an ARS
> > > (address-range-scrub) completes to communicate results to the
> > > per-namespace badblocks instances.
> > > 
> > > When the namespace is in btt mode we crash because we do not
> > > allocate a struct pmem_device instance in that case. Resulting in
> > > the following crash signature:
> > > 
> > >  BUG: unable to handle kernel NULL pointer dereference at
> > > 0000000000000030
> > >  IP: nd_pmem_notify+0x30/0xf0 [nd_pmem]
> > >  Call Trace:
> > >   nd_device_notify+0x40/0x50
> > >   child_notify+0x10/0x20
> > >   device_for_each_child+0x50/0x90
> > >   nd_region_notify+0x20/0x30
> > >   nd_device_notify+0x40/0x50
> > >   nvdimm_region_notify+0x27/0x30
> > >   acpi_nfit_scrub+0x341/0x590 [nfit]
> > >   process_one_work+0x197/0x450
> > >   worker_thread+0x4e/0x4a0
> > >   kthread+0x109/0x140
> > > 
> > > Given that we don't even populate the btt badblocks instance,
> > > just return early and skip the device to region lookup.
> > 
> > We populate the btt badblocks into nsio->bb, and check/clear them
> > in nsio_rw_bytes().
> 
> Argh, yes, we don't populate them out to the disk badblocks. I'll go
> with your patch.

Thanks!
-Toshi