diff options
| author | Daniel Axtens <dja@axtens.net> | 2015-07-10 02:04:25 +0300 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2015-07-10 04:44:25 +0300 |
| commit | 2c069a118fe1d80c47dca84e1561045fc7f3cc9e (patch) | |
| tree | ba055083f9ddb839ae809f48015d7d0eafa9cfa5 | |
| parent | 9958084a5275ca2e8f55c5b18729307f2f0cb53b (diff) | |
| download | linux-2c069a118fe1d80c47dca84e1561045fc7f3cc9e.tar.xz | |
cxl: Check if afu is not null in cxl_slbia
The pointer to an AFU in the adapter's list of AFUs can be null
if we're in the process of removing AFUs. The afu_list_lock
doesn't guard against this.
Say we have 2 slices, and we're in the process of removing cxl.
- We remove the AFUs in order (see cxl_remove). In cxl_remove_afu
for AFU 0, we take the lock, set adapter->afu[0] = NULL, and
release the lock.
- Then we get an slbia. In cxl_slbia we take the lock, and set
afu = adapter->afu[0], which is NULL.
- Therefore our attempt to check afu->enabled will blow up.
Therefore, check if afu is a null pointer before dereferencing it.
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Axtens <dja@axtens.net>
Acked-by: Michael Neuling <mikey@neuling.org>
Acked-by: Ian Munsie <imunsie@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
| -rw-r--r-- | drivers/misc/cxl/main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c index 833348e2c9cb..4a164ab8b35a 100644 --- a/drivers/misc/cxl/main.c +++ b/drivers/misc/cxl/main.c @@ -73,7 +73,7 @@ static inline void cxl_slbia_core(struct mm_struct *mm) spin_lock(&adapter->afu_list_lock); for (slice = 0; slice < adapter->slices; slice++) { afu = adapter->afu[slice]; - if (!afu->enabled) + if (!afu || !afu->enabled) continue; rcu_read_lock(); idr_for_each_entry(&afu->contexts_idr, ctx, id) |