• Yasunori Goto's avatar
    tools/testing/nvdimm: fix nfit_test buffer overflow · a117699c
    Yasunori Goto authored
    The root cause of panic is the num_pm of nfit_test1 is wrong.
    Though 1 is specified for num_pm at nfit_test_init(), it must be 2,
    because nfit_test1->spa_set[] array has 2 elements.
    
    Since the array is smaller than expected, the driver breaks other area.
    (it is often the link list of devres).
    
    As a result, panic occurs like the following example.
    
        CPU: 4 PID: 2233 Comm: lt-libndctl Tainted: G           O    4.12.0-rc1+ #12
        RIP: 0010:__list_del_entry_valid+0x6c/0xa0
        Call Trace:
         release_nodes+0x76/0x260
         devres_release_all+0x3c/0x50
         device_release_driver_internal+0x159/0x200
         device_release_driver+0x12/0x20
         bus_remove_device+0xfd/0x170
         device_del+0x1e8/0x330
         platform_device_del+0x28/0x90
         platform_device_unregister+0x12/0x30
         nfit_test_exit+0x2a/0x93b [nfit_test]
    
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarYasunori Goto <y-goto@jp.fujitsu.com>
    Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
    a117699c
nfit.c 56.4 KB