[PATCH] nvdimm: fix possible null-ptr-deref in nd_dax_probe()

[PATCH] nvdimm: fix possible null-ptr-deref in nd_dax_probe()

[Yi Yang]

It will cause null-ptr-deref when nd_dax_alloc() returns NULL, fix it by
add check for nd_dax_alloc().

Fixes: c5ed9268643c ("libnvdimm, dax: autodetect support")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
---
 drivers/nvdimm/dax_devs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
index 6b4922de3047..70a7e401f90d 100644
--- a/drivers/nvdimm/dax_devs.c
+++ b/drivers/nvdimm/dax_devs.c
@@ -106,6 +106,10 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
 
 	nvdimm_bus_lock(&ndns->dev);
 	nd_dax = nd_dax_alloc(nd_region);
+	if (!nd_dax) {
+		nvdimm_bus_unlock(&ndns->dev);
+		return -ENOMEM;
+	}
 	nd_pfn = &nd_dax->nd_pfn;
 	dax_dev = nd_pfn_devinit(nd_pfn, ndns);
 	nvdimm_bus_unlock(&ndns->dev);
-- 
2.25.1

Re: [PATCH] nvdimm: fix possible null-ptr-deref in nd_dax_probe()

[Ira Weiny]

Yi Yang wrote:
> It will cause null-ptr-deref when nd_dax_alloc() returns NULL, fix it by
> add check for nd_dax_alloc().

Was this found with a real workload or just by inspection?

Ira

> 
> Fixes: c5ed9268643c ("libnvdimm, dax: autodetect support")
> Signed-off-by: Yi Yang <yiyang13@huawei.com>
> ---
>  drivers/nvdimm/dax_devs.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
> index 6b4922de3047..70a7e401f90d 100644
> --- a/drivers/nvdimm/dax_devs.c
> +++ b/drivers/nvdimm/dax_devs.c
> @@ -106,6 +106,10 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
>  
>  	nvdimm_bus_lock(&ndns->dev);
>  	nd_dax = nd_dax_alloc(nd_region);
> +	if (!nd_dax) {
> +		nvdimm_bus_unlock(&ndns->dev);
> +		return -ENOMEM;
> +	}
>  	nd_pfn = &nd_dax->nd_pfn;
>  	dax_dev = nd_pfn_devinit(nd_pfn, ndns);
>  	nvdimm_bus_unlock(&ndns->dev);
> -- 
> 2.25.1
> 
> 

Re: [PATCH] nvdimm: fix possible null-ptr-deref in nd_dax_probe()

[yiyang (D)]

On 2024/10/28 22:17, Ira Weiny wrote:
> Yi Yang wrote:
>> It will cause null-ptr-deref when nd_dax_alloc() returns NULL, fix it by
>> add check for nd_dax_alloc().
> 
> Was this found with a real workload or just by inspection?
> 
> Ira
> 

I just found the problem by reading the code.

Regards,
Yiyang
>>
>> Fixes: c5ed9268643c ("libnvdimm, dax: autodetect support")
>> Signed-off-by: Yi Yang <yiyang13@huawei.com>
>> ---
>>   drivers/nvdimm/dax_devs.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
>> index 6b4922de3047..70a7e401f90d 100644
>> --- a/drivers/nvdimm/dax_devs.c
>> +++ b/drivers/nvdimm/dax_devs.c
>> @@ -106,6 +106,10 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
>>   
>>   	nvdimm_bus_lock(&ndns->dev);
>>   	nd_dax = nd_dax_alloc(nd_region);
>> +	if (!nd_dax) {
>> +		nvdimm_bus_unlock(&ndns->dev);
>> +		return -ENOMEM;
>> +	}
>>   	nd_pfn = &nd_dax->nd_pfn;
>>   	dax_dev = nd_pfn_devinit(nd_pfn, ndns);
>>   	nvdimm_bus_unlock(&ndns->dev);
>> -- 
>> 2.25.1
>>
>>
> 
> 
> 
> .
> 

Re: [PATCH] nvdimm: fix possible null-ptr-deref in nd_dax_probe()

[Dan Williams]

Yi Yang wrote:
> It will cause null-ptr-deref when nd_dax_alloc() returns NULL, fix it by
> add check for nd_dax_alloc().
> 
> Fixes: c5ed9268643c ("libnvdimm, dax: autodetect support")
> Signed-off-by: Yi Yang <yiyang13@huawei.com>
> ---
>  drivers/nvdimm/dax_devs.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
> index 6b4922de3047..70a7e401f90d 100644
> --- a/drivers/nvdimm/dax_devs.c
> +++ b/drivers/nvdimm/dax_devs.c
> @@ -106,6 +106,10 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
>  
>  	nvdimm_bus_lock(&ndns->dev);
>  	nd_dax = nd_dax_alloc(nd_region);
> +	if (!nd_dax) {
> +		nvdimm_bus_unlock(&ndns->dev);
> +		return -ENOMEM;
> +	}
>  	nd_pfn = &nd_dax->nd_pfn;

No, this isn't a NULL pointer de-reference, but it is indeed
unreasonably subtle.

If nd_dax is NULL, then nd_pfn is NULL because nd_dax is just a
type-wrapper around nd_pfn.

When nd_pfn is NULL then nd_pfn_devinit will fail.

What I think this needs to make this clear is something like this:

---

diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
index 6b4922de3047..37b743acbb7b 100644
--- a/drivers/nvdimm/dax_devs.c
+++ b/drivers/nvdimm/dax_devs.c
@@ -106,12 +106,12 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
 
 	nvdimm_bus_lock(&ndns->dev);
 	nd_dax = nd_dax_alloc(nd_region);
-	nd_pfn = &nd_dax->nd_pfn;
-	dax_dev = nd_pfn_devinit(nd_pfn, ndns);
+	dax_dev = nd_dax_devinit(nd_dax, ndns);
 	nvdimm_bus_unlock(&ndns->dev);
 	if (!dax_dev)
 		return -ENOMEM;
 	pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+	nd_pfn = &nd_dax->nd_pfn;
 	nd_pfn->pfn_sb = pfn_sb;
 	rc = nd_pfn_validate(nd_pfn, DAX_SIG);
 	dev_dbg(dev, "dax: %s\n", rc == 0 ? dev_name(dax_dev) : "<none>");
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index 2dbb1dca17b5..5ca06e9a2d29 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -600,6 +600,13 @@ struct nd_dax *to_nd_dax(struct device *dev);
 int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns);
 bool is_nd_dax(const struct device *dev);
 struct device *nd_dax_create(struct nd_region *nd_region);
+static inline struct device *nd_dax_devinit(struct nd_dax *nd_dax,
+					    struct nd_namespace_common *ndns)
+{
+	if (!nd_dax)
+		return NULL;
+	return nd_pfn_devinit(&nd_dax->nd_pfn, ndns);
+}
 #else
 static inline int nd_dax_probe(struct device *dev,
 		struct nd_namespace_common *ndns)

Re: [PATCH] nvdimm: fix possible null-ptr-deref in nd_dax_probe()

[yiyang (D)]

On 2024/10/29 0:26, Dan Williams wrote:
> Yi Yang wrote:
>> It will cause null-ptr-deref when nd_dax_alloc() returns NULL, fix it by
>> add check for nd_dax_alloc().
>>
>> Fixes: c5ed9268643c ("libnvdimm, dax: autodetect support")
>> Signed-off-by: Yi Yang <yiyang13@huawei.com>
>> ---
>>   drivers/nvdimm/dax_devs.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
>> index 6b4922de3047..70a7e401f90d 100644
>> --- a/drivers/nvdimm/dax_devs.c
>> +++ b/drivers/nvdimm/dax_devs.c
>> @@ -106,6 +106,10 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
>>   
>>   	nvdimm_bus_lock(&ndns->dev);
>>   	nd_dax = nd_dax_alloc(nd_region);
>> +	if (!nd_dax) {
>> +		nvdimm_bus_unlock(&ndns->dev);
>> +		return -ENOMEM;
>> +	}
>>   	nd_pfn = &nd_dax->nd_pfn;
> 
> No, this isn't a NULL pointer de-reference, but it is indeed
> unreasonably subtle.
> 
> If nd_dax is NULL, then nd_pfn is NULL because nd_dax is just a
> type-wrapper around nd_pfn.
> 
> When nd_pfn is NULL then nd_pfn_devinit will fail.
> 
> What I think this needs to make this clear is something like this:
> 
> ---
> 
> diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
> index 6b4922de3047..37b743acbb7b 100644
> --- a/drivers/nvdimm/dax_devs.c
> +++ b/drivers/nvdimm/dax_devs.c
> @@ -106,12 +106,12 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
>   
>   	nvdimm_bus_lock(&ndns->dev);
>   	nd_dax = nd_dax_alloc(nd_region);
> -	nd_pfn = &nd_dax->nd_pfn;
> -	dax_dev = nd_pfn_devinit(nd_pfn, ndns);
> +	dax_dev = nd_dax_devinit(nd_dax, ndns);
>   	nvdimm_bus_unlock(&ndns->dev);
>   	if (!dax_dev)
>   		return -ENOMEM;
>   	pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
> +	nd_pfn = &nd_dax->nd_pfn;
>   	nd_pfn->pfn_sb = pfn_sb;
>   	rc = nd_pfn_validate(nd_pfn, DAX_SIG);
>   	dev_dbg(dev, "dax: %s\n", rc == 0 ? dev_name(dax_dev) : "<none>");
> diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
> index 2dbb1dca17b5..5ca06e9a2d29 100644
> --- a/drivers/nvdimm/nd.h
> +++ b/drivers/nvdimm/nd.h
> @@ -600,6 +600,13 @@ struct nd_dax *to_nd_dax(struct device *dev);
>   int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns);
>   bool is_nd_dax(const struct device *dev);
>   struct device *nd_dax_create(struct nd_region *nd_region);
> +static inline struct device *nd_dax_devinit(struct nd_dax *nd_dax,
> +					    struct nd_namespace_common *ndns)
> +{
> +	if (!nd_dax)
> +		return NULL;
> +	return nd_pfn_devinit(&nd_dax->nd_pfn, ndns);
> +}
>   #else
>   static inline int nd_dax_probe(struct device *dev,
>   		struct nd_namespace_common *ndns)
> 
> .
> 

LGTM,.
Your code is better.

Best regards,
Yiyang

-- 

[PATCH] nvdimm: rectify the illogical code within nd_dax_probe()

[Yi Yang]

When nd_dax is NULL, nd_pfn is consequently NULL as well. Nevertheless,
it is inadvisable to perform pointer arithmetic or address-taking on a
NULL pointer.
Introduce the nd_dax_devinit() function to enhance the code's logic and
improve its readability.

Signed-off-by: Yi Yang <yiyang13@huawei.com>
---
 drivers/nvdimm/dax_devs.c | 4 ++--
 drivers/nvdimm/nd.h       | 7 +++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
index 6b4922de3047..37b743acbb7b 100644
--- a/drivers/nvdimm/dax_devs.c
+++ b/drivers/nvdimm/dax_devs.c
@@ -106,12 +106,12 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
 
 	nvdimm_bus_lock(&ndns->dev);
 	nd_dax = nd_dax_alloc(nd_region);
-	nd_pfn = &nd_dax->nd_pfn;
-	dax_dev = nd_pfn_devinit(nd_pfn, ndns);
+	dax_dev = nd_dax_devinit(nd_dax, ndns);
 	nvdimm_bus_unlock(&ndns->dev);
 	if (!dax_dev)
 		return -ENOMEM;
 	pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+	nd_pfn = &nd_dax->nd_pfn;
 	nd_pfn->pfn_sb = pfn_sb;
 	rc = nd_pfn_validate(nd_pfn, DAX_SIG);
 	dev_dbg(dev, "dax: %s\n", rc == 0 ? dev_name(dax_dev) : "<none>");
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index 2dbb1dca17b5..5ca06e9a2d29 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -600,6 +600,13 @@ struct nd_dax *to_nd_dax(struct device *dev);
 int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns);
 bool is_nd_dax(const struct device *dev);
 struct device *nd_dax_create(struct nd_region *nd_region);
+static inline struct device *nd_dax_devinit(struct nd_dax *nd_dax,
+					    struct nd_namespace_common *ndns)
+{
+	if (!nd_dax)
+		return NULL;
+	return nd_pfn_devinit(&nd_dax->nd_pfn, ndns);
+}
 #else
 static inline int nd_dax_probe(struct device *dev,
 		struct nd_namespace_common *ndns)
-- 
2.25.1

Re: [PATCH] nvdimm: rectify the illogical code within nd_dax_probe()

[Dave Jiang]

On 11/8/24 1:55 AM, Yi Yang wrote:
> When nd_dax is NULL, nd_pfn is consequently NULL as well. Nevertheless,
> it is inadvisable to perform pointer arithmetic or address-taking on a
> NULL pointer.
> Introduce the nd_dax_devinit() function to enhance the code's logic and
> improve its readability.
> 
> Signed-off-by: Yi Yang <yiyang13@huawei.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
but a few comments for future patches: 

Is this v2 of the patch? Please label patch subject prefix as so. 
> ---

Please include change history here from previous versions. 

>  drivers/nvdimm/dax_devs.c | 4 ++--
>  drivers/nvdimm/nd.h       | 7 +++++++
>  2 files changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
> index 6b4922de3047..37b743acbb7b 100644
> --- a/drivers/nvdimm/dax_devs.c
> +++ b/drivers/nvdimm/dax_devs.c
> @@ -106,12 +106,12 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
>  
>  	nvdimm_bus_lock(&ndns->dev);
>  	nd_dax = nd_dax_alloc(nd_region);
> -	nd_pfn = &nd_dax->nd_pfn;
> -	dax_dev = nd_pfn_devinit(nd_pfn, ndns);
> +	dax_dev = nd_dax_devinit(nd_dax, ndns);
>  	nvdimm_bus_unlock(&ndns->dev);
>  	if (!dax_dev)
>  		return -ENOMEM;
>  	pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
> +	nd_pfn = &nd_dax->nd_pfn;
>  	nd_pfn->pfn_sb = pfn_sb;
>  	rc = nd_pfn_validate(nd_pfn, DAX_SIG);
>  	dev_dbg(dev, "dax: %s\n", rc == 0 ? dev_name(dax_dev) : "<none>");
> diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
> index 2dbb1dca17b5..5ca06e9a2d29 100644
> --- a/drivers/nvdimm/nd.h
> +++ b/drivers/nvdimm/nd.h
> @@ -600,6 +600,13 @@ struct nd_dax *to_nd_dax(struct device *dev);
>  int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns);
>  bool is_nd_dax(const struct device *dev);
>  struct device *nd_dax_create(struct nd_region *nd_region);
> +static inline struct device *nd_dax_devinit(struct nd_dax *nd_dax,
> +					    struct nd_namespace_common *ndns)
> +{
> +	if (!nd_dax)
> +		return NULL;
> +	return nd_pfn_devinit(&nd_dax->nd_pfn, ndns);
> +}
>  #else
>  static inline int nd_dax_probe(struct device *dev,
>  		struct nd_namespace_common *ndns)