Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

tools/testing/nvdimm: Use per-DIMM device handle

KASAN reports a global-out-of-bounds access when running these nfit
tests: clear.sh, pmem-errors.sh, pfn-meta-errors.sh, btt-errors.sh,
daxdev-errors.sh, and inject-error.sh.

[] BUG: KASAN: global-out-of-bounds in nfit_test_ctl+0x769f/0x7840 [nfit_test]
[] Read of size 4 at addr ffffffffc03ea01c by task ndctl/1215
[] The buggy address belongs to the variable:
[] handle+0x1c/0x1df4 [nfit_test]

nfit_test_search_spa() uses handle[nvdimm->id] to retrieve a device
handle and triggers a KASAN error when it reads past the end of the
handle array. It should not be indexing the handle array at all.

The correct device handle is stored in per-DIMM test data. Each DIMM
has a struct nfit_mem that embeds a struct acpi_nfit_memdev that
describes the NFIT device handle. Use that device handle here.

Fixes: 10246dc84dfc ("acpi nfit: nfit_test supports translate SPA")
Cc: stable@vger.kernel.org
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>> ---
Link: https://patch.msgid.link/20251031234227.1303113-1-alison.schofield@intel.com
Signed-off-by: Ira Weiny <ira.weiny@intel.com>

authored by

Alison Schofield and committed by
Ira Weiny
f59b701b 43bc0aa1

+6 -1
+6 -1
tools/testing/nvdimm/test/nfit.c
··· 670 670 .addr = spa->spa, 671 671 .region = NULL, 672 672 }; 673 + struct nfit_mem *nfit_mem; 673 674 u64 dpa; 674 675 675 676 ret = device_for_each_child(&bus->dev, &ctx, ··· 688 687 */ 689 688 nd_mapping = &nd_region->mapping[nd_region->ndr_mappings - 1]; 690 689 nvdimm = nd_mapping->nvdimm; 690 + nfit_mem = nvdimm_provider_data(nvdimm); 691 + if (!nfit_mem) 692 + return -EINVAL; 691 693 692 - spa->devices[0].nfit_device_handle = handle[nvdimm->id]; 694 + spa->devices[0].nfit_device_handle = 695 + __to_nfit_memdev(nfit_mem)->device_handle; 693 696 spa->num_nvdimms = 1; 694 697 spa->devices[0].dpa = dpa; 695 698