Skip to content

Commit b68b77c

Browse files
djbwgregkh
authored andcommitted
libnvdimm, namespace: use a safe lookup for dimm device name
commit 4f86722 upstream. The following NULL dereference results from incorrectly assuming that ndd is valid in this print: struct nvdimm_drvdata *ndd = to_ndd(&nd_region->mapping[i]); /* * Give up if we don't find an instance of a uuid at each * position (from 0 to nd_region->ndr_mappings - 1), or if we * find a dimm with two instances of the same uuid. */ dev_err(&nd_region->dev, "%s missing label for %pUb\n", dev_name(ndd->dev), nd_label->uuid); BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 IP: nd_region_register_namespaces+0xd67/0x13c0 [libnvdimm] PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 43 PID: 673 Comm: kworker/u609:10 Not tainted 4.16.0-rc4+ #1 [..] RIP: 0010:nd_region_register_namespaces+0xd67/0x13c0 [libnvdimm] [..] Call Trace: ? devres_add+0x2f/0x40 ? devm_kmalloc+0x52/0x60 ? nd_region_activate+0x9c/0x320 [libnvdimm] nd_region_probe+0x94/0x260 [libnvdimm] ? kernfs_add_one+0xe4/0x130 nvdimm_bus_probe+0x63/0x100 [libnvdimm] Switch to using the nvdimm device directly. Fixes: 0e3b0d1 ("libnvdimm, namespace: allow multiple pmem...") Cc: <[email protected]> Reported-by: Dave Jiang <[email protected]> Signed-off-by: Dan Williams <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 45980ba commit b68b77c

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

drivers/nvdimm/namespace_devs.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1926,15 +1926,15 @@ struct device *create_namespace_pmem(struct nd_region *nd_region,
19261926
}
19271927

19281928
if (i < nd_region->ndr_mappings) {
1929-
struct nvdimm_drvdata *ndd = to_ndd(&nd_region->mapping[i]);
1929+
struct nvdimm *nvdimm = nd_region->mapping[i].nvdimm;
19301930

19311931
/*
19321932
* Give up if we don't find an instance of a uuid at each
19331933
* position (from 0 to nd_region->ndr_mappings - 1), or if we
19341934
* find a dimm with two instances of the same uuid.
19351935
*/
19361936
dev_err(&nd_region->dev, "%s missing label for %pUb\n",
1937-
dev_name(ndd->dev), nd_label->uuid);
1937+
nvdimm_name(nvdimm), nd_label->uuid);
19381938
rc = -EINVAL;
19391939
goto err;
19401940
}

0 commit comments

Comments
 (0)