diff options
| author | Yasunori Goto <y-goto@jp.fujitsu.com> | 2017-06-15 14:04:16 +0900 |
|---|---|---|
| committer | Dan Williams <dan.j.williams@intel.com> | 2017-06-15 14:31:41 -0700 |
| commit | a117699c6c4a4b1b4e90ed51e393590986567cb4 (patch) | |
| tree | 3d939774a4265cbb69bd5792a0e69ee6161cfa1b /tools/testing/nvdimm | |
| parent | 8990cdf10cf50dc68aaf5a8479b04304d05f1581 (diff) | |
| download | lwn-a117699c6c4a4b1b4e90ed51e393590986567cb4.tar.gz lwn-a117699c6c4a4b1b4e90ed51e393590986567cb4.zip | |
tools/testing/nvdimm: fix nfit_test buffer overflow
The root cause of panic is the num_pm of nfit_test1 is wrong.
Though 1 is specified for num_pm at nfit_test_init(), it must be 2,
because nfit_test1->spa_set[] array has 2 elements.
Since the array is smaller than expected, the driver breaks other area.
(it is often the link list of devres).
As a result, panic occurs like the following example.
CPU: 4 PID: 2233 Comm: lt-libndctl Tainted: G O 4.12.0-rc1+ #12
RIP: 0010:__list_del_entry_valid+0x6c/0xa0
Call Trace:
release_nodes+0x76/0x260
devres_release_all+0x3c/0x50
device_release_driver_internal+0x159/0x200
device_release_driver+0x12/0x20
bus_remove_device+0xfd/0x170
device_del+0x1e8/0x330
platform_device_del+0x28/0x90
platform_device_unregister+0x12/0x30
nfit_test_exit+0x2a/0x93b [nfit_test]
Cc: <stable@vger.kernel.org>
Signed-off-by: Yasunori Goto <y-goto@jp.fujitsu.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'tools/testing/nvdimm')
| -rw-r--r-- | tools/testing/nvdimm/test/nfit.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c index 28859da78edf..4c2fa98ef39d 100644 --- a/tools/testing/nvdimm/test/nfit.c +++ b/tools/testing/nvdimm/test/nfit.c @@ -1943,7 +1943,7 @@ static __init int nfit_test_init(void) nfit_test->setup = nfit_test0_setup; break; case 1: - nfit_test->num_pm = 1; + nfit_test->num_pm = 2; nfit_test->dcr_idx = NUM_DCR; nfit_test->num_dcr = 2; nfit_test->alloc = nfit_test1_alloc; |