From: "Pandey, Radhey Shyam" <radheys@amd.com>
To: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>,
linux-edac@vger.kernel.org
Cc: git@amd.com, shubhrajyoti.datta@gmail.com,
Michal Simek <michal.simek@amd.com>,
Borislav Petkov <bp@alien8.de>, Tony Luck <tony.luck@intel.com>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/9] EDAC/versalnet: Add NULL check for mci in remove_one_mc()
Date: Mon, 27 Jul 2026 13:41:52 +0530 [thread overview]
Message-ID: <4b6253ae-dad7-4591-ad11-8cebb31caa86@amd.com> (raw)
In-Reply-To: <20260724171945.2812749-3-shubhrajyoti.datta@amd.com>
On 7/24/2026 10:49 PM, Shubhrajyoti Datta wrote:
> If a controller's configuration specifies an unrecognized bus width,
> init_one_mc() returns 0 but skips allocating priv->mci[ctl_num], leaving
> it NULL. On module unload or probe failure, remove_one_mc() is called for
> all controllers and unconditionally dereferences priv->mci[i], causing a
> kernel panic.
>
> Add a NULL pointer check for mci before dereferencing it.
>
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000390
> Internal error: Oops: 0000000096000004 [#1] SMP
> Hardware name: Xilinx Versal NET VNX (DT)
> pc : mc_remove+0x34/0x88
> lr : mc_remove+0x4c/0x88
> Call trace:
> mc_remove+0x34/0x88
> platform_remove+0x2c/0x70
> device_remove+0x48/0x7c
> device_release_driver_internal+0x1c8/0x224
> device_driver_detach+0x18/0x28
> unbind_store+0xb4/0xb8
>
> Fixes: 62a9fc50e8d9 ("EDAC/versalnet: Refactor memory controller initialization and cleanup")
Confirm on fixes tag. The bug likely goes back to the original driver.
> Cc: stable@vger.kernel.org
There is no CC to stable kernel in email.
Below changes looks fine to me. With above tag fixed.
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Thanks!
> Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
> ---
>
> drivers/edac/versalnet_edac.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/edac/versalnet_edac.c b/drivers/edac/versalnet_edac.c
> index 316f8f79c4d8..05dc34504cc2 100644
> --- a/drivers/edac/versalnet_edac.c
> +++ b/drivers/edac/versalnet_edac.c
> @@ -769,6 +769,9 @@ static void remove_one_mc(struct mc_priv *priv, int i)
> struct mem_ctl_info *mci;
>
> mci = priv->mci[i];
> + if (!mci)
> + return;
> +
> device_unregister(mci->pdev);
> edac_mc_del_mc(mci->pdev);
> edac_mc_free(mci);
next prev parent reply other threads:[~2026-07-27 8:12 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-24 17:19 [PATCH 0/9] EDAC/versalnet: Fix error handling, teardown, and robustness Shubhrajyoti Datta
2026-07-24 17:19 ` [PATCH 1/9] EDAC/versalnet: Add NULL check for mci in handle_error() Shubhrajyoti Datta
2026-07-26 23:52 ` Borislav Petkov
2026-07-27 6:48 ` Pandey, Radhey Shyam
2026-07-24 17:19 ` [PATCH 2/9] EDAC/versalnet: Add NULL check for mci in remove_one_mc() Shubhrajyoti Datta
2026-07-27 8:11 ` Pandey, Radhey Shyam [this message]
2026-07-24 17:19 ` [PATCH 3/9] EDAC/versalnet: Move platform_set_drvdata() to mc_probe() Shubhrajyoti Datta
2026-07-27 8:35 ` Pandey, Radhey Shyam
2026-07-24 17:19 ` [PATCH 4/9] EDAC/versalnet: Fix device_register() error handling in init_one_mc() Shubhrajyoti Datta
2026-07-24 17:19 ` [PATCH 5/9] EDAC/versalnet: Use dev_set_name() instead of sprintf with init_name Shubhrajyoti Datta
2026-07-24 17:19 ` [PATCH 6/9] EDAC/versalnet: Initialize MCDI before RPMsg registration Shubhrajyoti Datta
2026-07-24 17:19 ` [PATCH 7/9] EDAC/versalnet: Add bounds validation in rpmsg_cb() Shubhrajyoti Datta
2026-07-24 17:19 ` [PATCH 8/9] EDAC/versalnet: Fix use-after-free in remove_one_mc() Shubhrajyoti Datta
2026-07-24 17:19 ` [PATCH 9/9] EDAC/versalnet: Use designated initializer for rpmsg_channel_info Shubhrajyoti Datta
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4b6253ae-dad7-4591-ad11-8cebb31caa86@amd.com \
--to=radheys@amd.com \
--cc=bp@alien8.de \
--cc=git@amd.com \
--cc=linux-edac@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=michal.simek@amd.com \
--cc=shubhrajyoti.datta@amd.com \
--cc=shubhrajyoti.datta@gmail.com \
--cc=tony.luck@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox