cxl: Check if afu is not null in cxl_slbia

Michael Ellerman mpe at ellerman.id.au
Fri Jul 10 16:55:06 AEST 2015


On Thu, 2015-09-07 at 23:04:25 UTC, Daniel Axtens wrote:
> The pointer to an AFU in the adapter's list of AFUs can be null
> if we're in the process of removing AFUs. The afu_list_lock
> doesn't guard against this.
> 
> Say we have 2 slices, and we're in the process of removing cxl.
>  - We remove the AFUs in order (see cxl_remove). In cxl_remove_afu
>    for AFU 0, we take the lock, set adapter->afu[0] = NULL, and
>    release the lock.
>  - Then we get an slbia. In cxl_slbia we take the lock, and set
>    afu = adapter->afu[0], which is NULL.
>  - Therefore our attempt to check afu->enabled will blow up.
> 
> Therefore, check if afu is a null pointer before dereferencing it.
>
Cc: stable at vger.kernel.org
> Signed-off-by: Daniel Axtens <dja at axtens.net>
> Acked-by: Michael Neuling <mikey at neuling.org>
> Acked-by: Ian Munsie <imunsie at au1.ibm.com>

Applied to powerpc fixes, thanks.

https://git.kernel.org/powerpc/c/2c069a118fe1d80c47dc

cheers


More information about the Linuxppc-dev mailing list