KASAN reports a global-out-of-bounds access when running these nfit tests: clear.sh, pmem-errors, pfn-meta-errors.sh, btt-errors.sh, daxdev-errors.sh, and inject-error.sh.
[] BUG: KASAN: global-out-of-bounds in nfit_test_ctl+0x769f/0x7840 [nfit_test] [] Read of size 4 at addr ffffffffc03ea01c by task ndctl/1215 [] The buggy address belongs to the variable: [] handle+0x1c/0x1df4 [nfit_test]
The nfit_test mock platform defines a static table of 7 NFIT DIMM handles, but nfit_test.0 builds 8 mock DIMMs total (5 DCR + 3 PM). When the final DIMM (id == 7) is selected, this code: spa->devices[0].nfit_device_handle = handle[nvdimm->id]; indexes past the end of the 7-entry table, triggering KASAN.
Fix this by adding an eighth entry to the handle[] table and a defensive bounds check so the test fails cleanly instead of dereferencing out-of-bounds memory.
To generate a unique handle, the new entry sets the 'imc' field rather than the 'chan' field. This matches the pattern of earlier entries and avoids introducing a non-zero 'chan' which is never used in the table. Computing the new handle shows no collision.
Notes from spelunkering for a Fixes Tag:
Commit 209851649dc4 ("acpi: nfit: Add support for hot-add") increased the mock DIMMs to eight yet kept the handle[] array at seven.
Commit 10246dc84dfc ("acpi nfit: nfit_test supports translate SPA") began using the last mock DIMM, triggering the KASAN.
Commit af31b04b67f4 ("tools/testing/nvdimm: Fix the array size for dimm devices.") addressed a related KASAN warning but not the actual handle array length.
Fixes: 209851649dc4 ("acpi: nfit: Add support for hot-add") Cc: stable@vger.kernel.org Signed-off-by: Alison Schofield alison.schofield@intel.com --- tools/testing/nvdimm/test/nfit.c | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c index cfd4378e2129..cdbf9e8ee80a 100644 --- a/tools/testing/nvdimm/test/nfit.c +++ b/tools/testing/nvdimm/test/nfit.c @@ -129,6 +129,7 @@ static u32 handle[] = { [4] = NFIT_DIMM_HANDLE(0, 1, 0, 0, 0), [5] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 0), [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1), + [7] = NFIT_DIMM_HANDLE(1, 0, 1, 0, 1), };
static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)]; @@ -688,6 +689,13 @@ static int nfit_test_search_spa(struct nvdimm_bus *bus, nd_mapping = &nd_region->mapping[nd_region->ndr_mappings - 1]; nvdimm = nd_mapping->nvdimm;
+ if (WARN_ON_ONCE(nvdimm->id >= ARRAY_SIZE(handle))) { + dev_err(&bus->dev, + "invalid nvdimm->id %u >= handle array size %zu\n", + nvdimm->id, ARRAY_SIZE(handle)); + return -EINVAL; + } + spa->devices[0].nfit_device_handle = handle[nvdimm->id]; spa->num_nvdimms = 1; spa->devices[0].dpa = dpa;
base-commit: 211ddde0823f1442e4ad052a2f30f050145ccada
On 10/29/25 5:42 PM, Alison Schofield wrote:
KASAN reports a global-out-of-bounds access when running these nfit tests: clear.sh, pmem-errors, pfn-meta-errors.sh, btt-errors.sh, daxdev-errors.sh, and inject-error.sh.
[] BUG: KASAN: global-out-of-bounds in nfit_test_ctl+0x769f/0x7840 [nfit_test] [] Read of size 4 at addr ffffffffc03ea01c by task ndctl/1215 [] The buggy address belongs to the variable: [] handle+0x1c/0x1df4 [nfit_test]
The nfit_test mock platform defines a static table of 7 NFIT DIMM handles, but nfit_test.0 builds 8 mock DIMMs total (5 DCR + 3 PM). When the final DIMM (id == 7) is selected, this code: spa->devices[0].nfit_device_handle = handle[nvdimm->id]; indexes past the end of the 7-entry table, triggering KASAN.
Fix this by adding an eighth entry to the handle[] table and a defensive bounds check so the test fails cleanly instead of dereferencing out-of-bounds memory.
To generate a unique handle, the new entry sets the 'imc' field rather than the 'chan' field. This matches the pattern of earlier entries and avoids introducing a non-zero 'chan' which is never used in the table. Computing the new handle shows no collision.
Notes from spelunkering for a Fixes Tag:
Commit 209851649dc4 ("acpi: nfit: Add support for hot-add") increased the mock DIMMs to eight yet kept the handle[] array at seven.
Commit 10246dc84dfc ("acpi nfit: nfit_test supports translate SPA") began using the last mock DIMM, triggering the KASAN.
Commit af31b04b67f4 ("tools/testing/nvdimm: Fix the array size for dimm devices.") addressed a related KASAN warning but not the actual handle array length.
Fixes: 209851649dc4 ("acpi: nfit: Add support for hot-add") Cc: stable@vger.kernel.org Signed-off-by: Alison Schofield alison.schofield@intel.com
Reviewed-by: Dave Jiang dave.jiang@intel.com> ---
tools/testing/nvdimm/test/nfit.c | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c index cfd4378e2129..cdbf9e8ee80a 100644 --- a/tools/testing/nvdimm/test/nfit.c +++ b/tools/testing/nvdimm/test/nfit.c @@ -129,6 +129,7 @@ static u32 handle[] = { [4] = NFIT_DIMM_HANDLE(0, 1, 0, 0, 0), [5] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 0), [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1),
- [7] = NFIT_DIMM_HANDLE(1, 0, 1, 0, 1),
}; static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)]; @@ -688,6 +689,13 @@ static int nfit_test_search_spa(struct nvdimm_bus *bus, nd_mapping = &nd_region->mapping[nd_region->ndr_mappings - 1]; nvdimm = nd_mapping->nvdimm;
- if (WARN_ON_ONCE(nvdimm->id >= ARRAY_SIZE(handle))) {
dev_err(&bus->dev,"invalid nvdimm->id %u >= handle array size %zu\n",nvdimm->id, ARRAY_SIZE(handle));return -EINVAL;- }
- spa->devices[0].nfit_device_handle = handle[nvdimm->id]; spa->num_nvdimms = 1; spa->devices[0].dpa = dpa;
base-commit: 211ddde0823f1442e4ad052a2f30f050145ccada
Alison Schofield wrote:
KASAN reports a global-out-of-bounds access when running these nfit tests: clear.sh, pmem-errors, pfn-meta-errors.sh, btt-errors.sh, daxdev-errors.sh, and inject-error.sh.
[] BUG: KASAN: global-out-of-bounds in nfit_test_ctl+0x769f/0x7840 [nfit_test] [] Read of size 4 at addr ffffffffc03ea01c by task ndctl/1215 [] The buggy address belongs to the variable: [] handle+0x1c/0x1df4 [nfit_test]
The nfit_test mock platform defines a static table of 7 NFIT DIMM handles, but nfit_test.0 builds 8 mock DIMMs total (5 DCR + 3 PM).
That does not sound right. NUM_PM is not adding DIMM devices.
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c index cfd4378e2129..cdbf9e8ee80a 100644 --- a/tools/testing/nvdimm/test/nfit.c +++ b/tools/testing/nvdimm/test/nfit.c @@ -129,6 +129,7 @@ static u32 handle[] = { [4] = NFIT_DIMM_HANDLE(0, 1, 0, 0, 0), [5] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 0), [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1),
- [7] = NFIT_DIMM_HANDLE(1, 0, 1, 0, 1),
}; static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)]; @@ -688,6 +689,13 @@ static int nfit_test_search_spa(struct nvdimm_bus *bus, nd_mapping = &nd_region->mapping[nd_region->ndr_mappings - 1]; nvdimm = nd_mapping->nvdimm;
- if (WARN_ON_ONCE(nvdimm->id >= ARRAY_SIZE(handle))) {
dev_err(&bus->dev,"invalid nvdimm->id %u >= handle array size %zu\n",nvdimm->id, ARRAY_SIZE(handle));return -EINVAL;- }
No, I think the bug is assuming that the nvdimm device id is the handle lookup.
I.e. this looks wrong to me:
spa->devices[0].nfit_device_handle = handle[nvdimm->id];
...does something like this also fix the warning? (UNTESTED, not even compiled!):
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c index cfd4378e2129..5456f67b7e43 100644 --- a/tools/testing/nvdimm/test/nfit.c +++ b/tools/testing/nvdimm/test/nfit.c @@ -688,7 +688,8 @@ static int nfit_test_search_spa(struct nvdimm_bus *bus, nd_mapping = &nd_region->mapping[nd_region->ndr_mappings - 1]; nvdimm = nd_mapping->nvdimm;
- spa->devices[0].nfit_device_handle = handle[nvdimm->id]; + nfit_mem = nvdimm_provider_data(nvdimm); + spa->devices[0].nfit_device_handle = __to_nfit_memdev(nfit_mem)->device_handle; spa->num_nvdimms = 1; spa->devices[0].dpa = dpa;
On Fri, Oct 31, 2025 at 01:42:13PM -0700, Dan Williams wrote:
Alison Schofield wrote:
KASAN reports a global-out-of-bounds access when running these nfit tests: clear.sh, pmem-errors, pfn-meta-errors.sh, btt-errors.sh, daxdev-errors.sh, and inject-error.sh.
[] BUG: KASAN: global-out-of-bounds in nfit_test_ctl+0x769f/0x7840 [nfit_test] [] Read of size 4 at addr ffffffffc03ea01c by task ndctl/1215 [] The buggy address belongs to the variable: [] handle+0x1c/0x1df4 [nfit_test]
The nfit_test mock platform defines a static table of 7 NFIT DIMM handles, but nfit_test.0 builds 8 mock DIMMs total (5 DCR + 3 PM).
That does not sound right. NUM_PM is not adding DIMM devices.
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c index cfd4378e2129..cdbf9e8ee80a 100644 --- a/tools/testing/nvdimm/test/nfit.c +++ b/tools/testing/nvdimm/test/nfit.c @@ -129,6 +129,7 @@ static u32 handle[] = { [4] = NFIT_DIMM_HANDLE(0, 1, 0, 0, 0), [5] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 0), [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1),
- [7] = NFIT_DIMM_HANDLE(1, 0, 1, 0, 1),
}; static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)]; @@ -688,6 +689,13 @@ static int nfit_test_search_spa(struct nvdimm_bus *bus, nd_mapping = &nd_region->mapping[nd_region->ndr_mappings - 1]; nvdimm = nd_mapping->nvdimm;
- if (WARN_ON_ONCE(nvdimm->id >= ARRAY_SIZE(handle))) {
dev_err(&bus->dev,"invalid nvdimm->id %u >= handle array size %zu\n",nvdimm->id, ARRAY_SIZE(handle));return -EINVAL;- }
No, I think the bug is assuming that the nvdimm device id is the handle lookup.
I.e. this looks wrong to me:
spa->devices[0].nfit_device_handle = handle[nvdimm->id];
...does something like this also fix the warning? (UNTESTED, not even compiled!):
Dan - This does fix it...and I basically get it. v2'ing. Thanks!
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c index cfd4378e2129..5456f67b7e43 100644 --- a/tools/testing/nvdimm/test/nfit.c +++ b/tools/testing/nvdimm/test/nfit.c @@ -688,7 +688,8 @@ static int nfit_test_search_spa(struct nvdimm_bus *bus, nd_mapping = &nd_region->mapping[nd_region->ndr_mappings - 1]; nvdimm = nd_mapping->nvdimm;
spa->devices[0].nfit_device_handle = handle[nvdimm->id];
nfit_mem = nvdimm_provider_data(nvdimm);spa->devices[0].nfit_device_handle = __to_nfit_memdev(nfit_mem)->device_handle; spa->num_nvdimms = 1; spa->devices[0].dpa = dpa;
linux-stable-mirror@lists.linaro.org
-
Alison Schofield -
dan.j.williams＠intel.com -
Dave Jiang