From: Robert Richter <rrichter@amd.com>
To: Vishal Verma <vishal.l.verma@intel.com>,
Ira Weiny <ira.weiny@intel.com>,
Dan Williams <dan.j.williams@intel.com>,
Dave Jiang <dave.jiang@intel.com>
Cc: Alison Schofield <alison.schofield@intel.com>,
Jonathan Cameron <Jonathan.Cameron@huawei.com>,
<linux-cxl@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
Davidlohr Bueso <dave@stgolabs.net>,
"Gregory Price" <gourry@gourry.net>,
Terry Bowman <terry.bowman@amd.com>,
"Robert Richter" <rrichter@amd.com>, <nvdimm@lists.linux.dev>
Subject: [PATCH] libnvdimm/labels: Fix divide error in nd_label_data_init()
Date: Wed, 19 Mar 2025 12:32:14 +0100 [thread overview]
Message-ID: <20250319113215.520902-1-rrichter@amd.com> (raw)
If a CXL memory device returns a broken zero LSA size in its memory
device information (Identify Memory Device (Opcode 4000h), CXL
spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm
driver:
Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI
RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm]
Code and flow:
1) CXL Command 4000h returns LSA size = 0,
2) config_size is assigned to zero LSA size (CXL pmem driver):
drivers/cxl/pmem.c: .config_size = mds->lsa_size,
3) max_xfer is set to zero (nvdimm driver):
drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size);
drivers/nvdimm/label.c: if (read_size < max_xfer) {
drivers/nvdimm/label.c- /* trim waste */
4) DIV_ROUND_UP() causes division by zero:
drivers/nvdimm/label.c: max_xfer -= ((max_xfer - 1) - (config_size - 1) % max_xfer) /
drivers/nvdimm/label.c: DIV_ROUND_UP(config_size, max_xfer);
drivers/nvdimm/label.c- /* make certain we read indexes in exactly 1 read */
drivers/nvdimm/label.c: if (max_xfer < read_size)
drivers/nvdimm/label.c: max_xfer = read_size;
drivers/nvdimm/label.c- }
Fix this by checking the config size parameter by extending an
existing check.
Signed-off-by: Robert Richter <rrichter@amd.com>
---
drivers/nvdimm/label.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
index 082253a3a956..04f4a049599a 100644
--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -442,7 +442,8 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd)
if (ndd->data)
return 0;
- if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0) {
+ if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0 ||
+ ndd->nsarea.config_size == 0) {
dev_dbg(ndd->dev, "failed to init config data area: (%u:%u)\n",
ndd->nsarea.max_xfer, ndd->nsarea.config_size);
return -ENXIO;
--
2.39.5
next reply other threads:[~2025-03-19 11:32 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-19 11:32 Robert Richter [this message]
2025-03-19 12:10 ` [PATCH] libnvdimm/labels: Fix divide error in nd_label_data_init() Gupta, Pankaj
2025-03-19 19:33 ` Ira Weiny
2025-03-20 11:07 ` Robert Richter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250319113215.520902-1-rrichter@amd.com \
--to=rrichter@amd.com \
--cc=Jonathan.Cameron@huawei.com \
--cc=alison.schofield@intel.com \
--cc=dan.j.williams@intel.com \
--cc=dave.jiang@intel.com \
--cc=dave@stgolabs.net \
--cc=gourry@gourry.net \
--cc=ira.weiny@intel.com \
--cc=linux-cxl@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nvdimm@lists.linux.dev \
--cc=terry.bowman@amd.com \
--cc=vishal.l.verma@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox