1
0
Fork 0
alistair23-linux/tools/testing/nvdimm
Yasunori Goto a117699c6c tools/testing/nvdimm: fix nfit_test buffer overflow
The root cause of panic is the num_pm of nfit_test1 is wrong.
Though 1 is specified for num_pm at nfit_test_init(), it must be 2,
because nfit_test1->spa_set[] array has 2 elements.

Since the array is smaller than expected, the driver breaks other area.
(it is often the link list of devres).

As a result, panic occurs like the following example.

    CPU: 4 PID: 2233 Comm: lt-libndctl Tainted: G           O    4.12.0-rc1+ #12
    RIP: 0010:__list_del_entry_valid+0x6c/0xa0
    Call Trace:
     release_nodes+0x76/0x260
     devres_release_all+0x3c/0x50
     device_release_driver_internal+0x159/0x200
     device_release_driver+0x12/0x20
     bus_remove_device+0xfd/0x170
     device_del+0x1e8/0x330
     platform_device_del+0x28/0x90
     platform_device_unregister+0x12/0x30
     nfit_test_exit+0x2a/0x93b [nfit_test]

Cc: <stable@vger.kernel.org>
Signed-off-by: Yasunori Goto <y-goto@jp.fujitsu.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2017-06-15 14:31:41 -07:00
..
test tools/testing/nvdimm: fix nfit_test buffer overflow 2017-06-15 14:31:41 -07:00
Kbuild Merge branch 'for-4.12/dax' into libnvdimm-for-next 2017-05-04 23:38:43 -07:00
Makefile
config_check.c treewide: remove redundant #include <linux/kconfig.h> 2016-10-11 15:06:33 -07:00
dax-dev.c Merge branch 'for-4.12/dax' into libnvdimm-for-next 2017-05-04 23:38:43 -07:00
pmem-dax.c pmem: add dax_operations support 2017-04-19 15:14:35 -07:00