Patch "tools/testing/nvdimm: fix nfit_test buffer overflow" has been added to the 4.12-stable tree
Subsystems (2)
This is a note to let you know that I've just added the patch titled
tools/testing/nvdimm: fix nfit_test buffer overflow
to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
tools-testing-nvdimm-fix-nfit_test-buffer-overflow.patch
and it can be found in the queue-4.12 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
a117699c6c4a4b1b4e90ed51e393590986567cb4Mon Sep 17 00:00:00 2001
From: Yasunori Goto <[email protected]>
Date: Thu, 15 Jun 2017 14:04:16 +0900
Subject: tools/testing/nvdimm: fix nfit_test buffer overflow
From: Yasunori Goto <[email protected]>
commit a117699c6c4a4b1b4e90ed51e393590986567cb4 upstream.
The root cause of panic is the num_pm of nfit_test1 is wrong. Though 1 is specified for num_pm at nfit_test_init(), it must be 2, because nfit_test1->spa_set[] array has 2 elements.
Since the array is smaller than expected, the driver breaks other area. (it is often the link list of devres).
As a result, panic occurs like the following example.
CPU: 4 PID: 2233 Comm: lt-libndctl Tainted: G O 4.12.0-rc1+ #12
RIP: 0010:__list_del_entry_valid+0x6c/0xa0
Call Trace:
release_nodes+0x76/0x260
devres_release_all+0x3c/0x50
device_release_driver_internal+0x159/0x200
device_release_driver+0x12/0x20
bus_remove_device+0xfd/0x170
device_del+0x1e8/0x330
platform_device_del+0x28/0x90
platform_device_unregister+0x12/0x30
nfit_test_exit+0x2a/0x93b [nfit_test]--- tools/testing/nvdimm/test/nfit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/nvdimm/test/nfit.c +1 -1
@@ -1943,7 +1943,7 @@ static __init int nfit_test_init(void) nfit_test->setup = nfit_test0_setup;break ;case 1 : - nfit_test->num_pm =1 ; + nfit_test->num_pm =2 ; nfit_test->dcr_idx =NUM_DCR ; nfit_test->num_dcr =2 ; nfit_test->alloc = nfit_test1_alloc;
Patches currently in stable-queue which might be from [email protected] are
queue-4.12/tools-testing-nvdimm-fix-nfit_test-buffer-overflow.patch