Revision 2c069a118fe1d80c47dca84e1561045fc7f3cc9e authored by Daniel Axtens on 09 July 2015, 23:04:25 UTC, committed by Michael Ellerman on 10 July 2015, 01:44:25 UTC
The pointer to an AFU in the adapter's list of AFUs can be null if we're in the process of removing AFUs. The afu_list_lock doesn't guard against this. Say we have 2 slices, and we're in the process of removing cxl. - We remove the AFUs in order (see cxl_remove). In cxl_remove_afu for AFU 0, we take the lock, set adapter->afu[0] = NULL, and release the lock. - Then we get an slbia. In cxl_slbia we take the lock, and set afu = adapter->afu[0], which is NULL. - Therefore our attempt to check afu->enabled will blow up. Therefore, check if afu is a null pointer before dereferencing it. Cc: stable@vger.kernel.org Signed-off-by: Daniel Axtens <dja@axtens.net> Acked-by: Michael Neuling <mikey@neuling.org> Acked-by: Ian Munsie <imunsie@au1.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
1 parent 9958084
| File | Mode | Size |
|---|---|---|
| apparmor | ||
| integrity | ||
| keys | ||
| selinux | ||
| smack | ||
| tomoyo | ||
| yama | ||
| Kconfig | -rw-r--r-- | 5.7 KB |
| Makefile | -rw-r--r-- | 900 bytes |
| commoncap.c | -rw-r--r-- | 29.1 KB |
| device_cgroup.c | -rw-r--r-- | 21.1 KB |
| inode.c | -rw-r--r-- | 6.5 KB |
| lsm_audit.c | -rw-r--r-- | 9.5 KB |
| min_addr.c | -rw-r--r-- | 1.3 KB |
| security.c | -rw-r--r-- | 53.2 KB |
Computing file changes ...
