Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

cxl: Check if afu is not null in cxl_slbia

The pointer to an AFU in the adapter's list of AFUs can be null
if we're in the process of removing AFUs. The afu_list_lock
doesn't guard against this.

Say we have 2 slices, and we're in the process of removing cxl.
- We remove the AFUs in order (see cxl_remove). In cxl_remove_afu
for AFU 0, we take the lock, set adapter->afu[0] = NULL, and
release the lock.
- Then we get an slbia. In cxl_slbia we take the lock, and set
afu = adapter->afu[0], which is NULL.
- Therefore our attempt to check afu->enabled will blow up.

Therefore, check if afu is a null pointer before dereferencing it.

Cc: stable@vger.kernel.org
Signed-off-by: Daniel Axtens <dja@axtens.net>
Acked-by: Michael Neuling <mikey@neuling.org>
Acked-by: Ian Munsie <imunsie@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

authored by

Daniel Axtens and committed by
Michael Ellerman
2c069a11 9958084a

+1 -1
+1 -1
drivers/misc/cxl/main.c
··· 73 73 spin_lock(&adapter->afu_list_lock); 74 74 for (slice = 0; slice < adapter->slices; slice++) { 75 75 afu = adapter->afu[slice]; 76 - if (!afu->enabled) 76 + if (!afu || !afu->enabled) 77 77 continue; 78 78 rcu_read_lock(); 79 79 idr_for_each_entry(&afu->contexts_idr, ctx, id)