Re: [PATCH] tools/testing/nvdimm: Stop read past end of global handle array

[Dave Jiang <dave.jiang@intel.com>]

On 10/29/25 5:42 PM, Alison Schofield wrote:
> KASAN reports a global-out-of-bounds access when running these nfit
> tests: clear.sh, pmem-errors, pfn-meta-errors.sh, btt-errors.sh,
> daxdev-errors.sh, and inject-error.sh.
> 
> [] BUG: KASAN: global-out-of-bounds in nfit_test_ctl+0x769f/0x7840 [nfit_test]
> [] Read of size 4 at addr ffffffffc03ea01c by task ndctl/1215
> [] The buggy address belongs to the variable:
> [] handle+0x1c/0x1df4 [nfit_test]
> 
> The nfit_test mock platform defines a static table of 7 NFIT DIMM
> handles, but nfit_test.0 builds 8 mock DIMMs total (5 DCR + 3 PM).
> When the final DIMM (id == 7) is selected, this code:
>     spa->devices[0].nfit_device_handle = handle[nvdimm->id];
> indexes past the end of the 7-entry table, triggering KASAN.
> 
> Fix this by adding an eighth entry to the handle[] table and a
> defensive bounds check so the test fails cleanly instead of
> dereferencing out-of-bounds memory.
> 
> To generate a unique handle, the new entry sets the 'imc' field rather
> than the 'chan' field. This matches the pattern of earlier entries
> and avoids introducing a non-zero 'chan' which is never used in the
> table. Computing the new handle shows no collision.
> 
> Notes from spelunkering for a Fixes Tag:
> 
> Commit 209851649dc4 ("acpi: nfit: Add support for hot-add") increased
> the mock DIMMs to eight yet kept the handle[] array at seven.
> 
> Commit 10246dc84dfc ("acpi nfit: nfit_test supports translate SPA")
> began using the last mock DIMM, triggering the KASAN.
> 
> Commit af31b04b67f4 ("tools/testing/nvdimm: Fix the array size for
> dimm devices.") addressed a related KASAN warning but not the actual
> handle array length.
> 
> Fixes: 209851649dc4 ("acpi: nfit: Add support for hot-add")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Alison Schofield <alison.schofield@intel.com>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>> ---
>  tools/testing/nvdimm/test/nfit.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
> index cfd4378e2129..cdbf9e8ee80a 100644
> --- a/tools/testing/nvdimm/test/nfit.c
> +++ b/tools/testing/nvdimm/test/nfit.c
> @@ -129,6 +129,7 @@ static u32 handle[] = {
>  	[4] = NFIT_DIMM_HANDLE(0, 1, 0, 0, 0),
>  	[5] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 0),
>  	[6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1),
> +	[7] = NFIT_DIMM_HANDLE(1, 0, 1, 0, 1),
>  };
>  
>  static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)];
> @@ -688,6 +689,13 @@ static int nfit_test_search_spa(struct nvdimm_bus *bus,
>  	nd_mapping = &nd_region->mapping[nd_region->ndr_mappings - 1];
>  	nvdimm = nd_mapping->nvdimm;
>  
> +	if (WARN_ON_ONCE(nvdimm->id >= ARRAY_SIZE(handle))) {
> +		dev_err(&bus->dev,
> +			"invalid nvdimm->id %u >= handle array size %zu\n",
> +			nvdimm->id, ARRAY_SIZE(handle));
> +		return -EINVAL;
> +	}
> +
>  	spa->devices[0].nfit_device_handle = handle[nvdimm->id];
>  	spa->num_nvdimms = 1;
>  	spa->devices[0].dpa = dpa;
> 
> base-commit: 211ddde0823f1442e4ad052a2f30f050145ccada