• Dan Williams's avatar
    acpi, nfit: fix acpi_nfit_flush_probe() crash · e471486c
    Dan Williams authored
    We queue an on-stack work item to 'nfit_wq' and wait for it to complete
    as part of a 'flush_probe' request. However, if the user cancels the
    wait we need to make sure the item is flushed from the queue otherwise
    we are leaving an out-of-scope stack address on the work list.
    
     BUG: unable to handle kernel paging request at ffffbcb3c72f7cd0
     IP: [<ffffffffa9413a7b>] __list_add+0x1b/0xb0
     [..]
     RIP: 0010:[<ffffffffa9413a7b>]  [<ffffffffa9413a7b>] __list_add+0x1b/0xb0
     RSP: 0018:ffffbcb3c7ba7c00  EFLAGS: 00010046
     [..]
     Call Trace:
      [<ffffffffa90bb11a>] insert_work+0x3a/0xc0
      [<ffffffffa927fdda>] ? seq_open+0x5a/0xa0
      [<ffffffffa90bb30a>] __queue_work+0x16a/0x460
      [<ffffffffa90bbb08>] queue_work_on+0x38/0x40
      [<ffffffffc0cf2685>] acpi_nfit_flush_probe+0x95/0xc0 [nfit]
      [<ffffffffc0cf25d0>] ? nfit_visible+0x40/0x40 [nfit]
      [<ffffffffa9571495>] wait_probe_show+0x25/0x60
      [<ffffffffa9546b30>] dev_attr_show+0x20/0x50
    
    Fixes: 7ae0fa43 ("nfit, libnvdimm: async region scrub workqueue")
    Cc: <stable@vger.kernel.org>
    Reviewed-by: default avatarVishal Verma <vishal.l.verma@intel.com>
    Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
    e471486c
core.c 78.5 KB