• Daniel Axtens's avatar
    cxl: Check if afu is not null in cxl_slbia · 2c069a11
    Daniel Axtens authored
    The pointer to an AFU in the adapter's list of AFUs can be null
    if we're in the process of removing AFUs. The afu_list_lock
    doesn't guard against this.
    
    Say we have 2 slices, and we're in the process of removing cxl.
     - We remove the AFUs in order (see cxl_remove). In cxl_remove_afu
       for AFU 0, we take the lock, set adapter->afu[0] = NULL, and
       release the lock.
     - Then we get an slbia. In cxl_slbia we take the lock, and set
       afu = adapter->afu[0], which is NULL.
     - Therefore our attempt to check afu->enabled will blow up.
    
    Therefore, check if afu is a null pointer before dereferencing it.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarDaniel Axtens <dja@axtens.net>
    Acked-by: default avatarMichael Neuling <mikey@neuling.org>
    Acked-by: default avatarIan Munsie <imunsie@au1.ibm.com>
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    2c069a11
main.c 5.42 KB