Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

tools/testing/nvdimm: fix nfit_test shutdown crash

Keep the nfit_test instances alive until after nfit_test_teardown(), as
we may be doing resource lookups until the final un-registrations have
completed. This fixes crashes of the form.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
IP: __release_resource+0x12/0x90
Call Trace:
remove_resource+0x23/0x40
__wrap_remove_resource+0x29/0x30 [nfit_test_iomap]
acpi_nfit_remove_resource+0xe/0x10 [nfit]
devm_action_release+0xf/0x20
release_nodes+0x16d/0x2b0
devres_release_all+0x3c/0x60
device_release+0x21/0x90
kobject_release+0x6a/0x170
kobject_put+0x2f/0x60
put_device+0x17/0x20
platform_device_unregister+0x20/0x30
nfit_test_exit+0x36/0x960 [nfit_test]

Reported-by: Linda Knippers <linda.knippers@hpe.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

+9 -1
+9 -1
tools/testing/nvdimm/test/nfit.c
··· 1958 1958 put_device(&pdev->dev); 1959 1959 goto err_register; 1960 1960 } 1961 + get_device(&pdev->dev); 1961 1962 1962 1963 rc = dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)); 1963 1964 if (rc) ··· 1977 1976 if (instances[i]) 1978 1977 platform_device_unregister(&instances[i]->pdev); 1979 1978 nfit_test_teardown(); 1979 + for (i = 0; i < NUM_NFITS; i++) 1980 + if (instances[i]) 1981 + put_device(&instances[i]->pdev.dev); 1982 + 1980 1983 return rc; 1981 1984 } 1982 1985 ··· 1988 1983 { 1989 1984 int i; 1990 1985 1991 - platform_driver_unregister(&nfit_test_driver); 1992 1986 for (i = 0; i < NUM_NFITS; i++) 1993 1987 platform_device_unregister(&instances[i]->pdev); 1988 + platform_driver_unregister(&nfit_test_driver); 1994 1989 nfit_test_teardown(); 1990 + 1991 + for (i = 0; i < NUM_NFITS; i++) 1992 + put_device(&instances[i]->pdev.dev); 1995 1993 class_destroy(nfit_test_dimm); 1996 1994 } 1997 1995