On Fri, Oct 31, 2025 at 01:42:13PM -0700, Dan Williams wrote:
> Alison Schofield wrote:
> > KASAN reports a global-out-of-bounds access when running these nfit
> > tests: clear.sh, pmem-errors, pfn-meta-errors.sh, btt-errors.sh,
> > daxdev-errors.sh, and inject-error.sh.
> >
> > [] BUG: KASAN: global-out-of-bounds in nfit_test_ctl+0x769f/0x7840
> > [nfit_test]
> > [] Read of size 4 at addr ffffffffc03ea01c by task ndctl/1215
> > [] The buggy address belongs to the variable:
> > [] handle+0x1c/0x1df4 [nfit_test]
> >
> > The nfit_test mock platform defines a static table of 7 NFIT DIMM
> > handles, but nfit_test.0 builds 8 mock DIMMs total (5 DCR + 3 PM).
>
> That does not sound right. NUM_PM is not adding DIMM devices.
>
> > diff --git a/tools/testing/nvdimm/test/nfit.c
> > b/tools/testing/nvdimm/test/nfit.c
> > index cfd4378e2129..cdbf9e8ee80a 100644
> > --- a/tools/testing/nvdimm/test/nfit.c
> > +++ b/tools/testing/nvdimm/test/nfit.c
> > @@ -129,6 +129,7 @@ static u32 handle[] = {
> > [4] = NFIT_DIMM_HANDLE(0, 1, 0, 0, 0),
> > [5] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 0),
> > [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1),
> > + [7] = NFIT_DIMM_HANDLE(1, 0, 1, 0, 1),
> > };
> >
> > static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)];
> > @@ -688,6 +689,13 @@ static int nfit_test_search_spa(struct nvdimm_bus *bus,
> > nd_mapping = &nd_region->mapping[nd_region->ndr_mappings - 1];
> > nvdimm = nd_mapping->nvdimm;
> >
> > + if (WARN_ON_ONCE(nvdimm->id >= ARRAY_SIZE(handle))) {
> > + dev_err(&bus->dev,
> > + "invalid nvdimm->id %u >= handle array size %zu\n",
> > + nvdimm->id, ARRAY_SIZE(handle));
> > + return -EINVAL;
> > + }
>
> No, I think the bug is assuming that the nvdimm device id is the handle
> lookup.
>
> I.e. this looks wrong to me:
>
> spa->devices[0].nfit_device_handle = handle[nvdimm->id];
>
> ...does something like this also fix the warning? (UNTESTED, not even
> compiled!):
Dan - This does fix it...and I basically get it. v2'ing. Thanks!
>
> diff --git a/tools/testing/nvdimm/test/nfit.c
> b/tools/testing/nvdimm/test/nfit.c
> index cfd4378e2129..5456f67b7e43 100644
> --- a/tools/testing/nvdimm/test/nfit.c
> +++ b/tools/testing/nvdimm/test/nfit.c
> @@ -688,7 +688,8 @@ static int nfit_test_search_spa(struct nvdimm_bus *bus,
> nd_mapping = &nd_region->mapping[nd_region->ndr_mappings - 1];
> nvdimm = nd_mapping->nvdimm;
>
> - spa->devices[0].nfit_device_handle = handle[nvdimm->id];
> + nfit_mem = nvdimm_provider_data(nvdimm);
> + spa->devices[0].nfit_device_handle =
> __to_nfit_memdev(nfit_mem)->device_handle;
> spa->num_nvdimms = 1;
> spa->devices[0].dpa = dpa;
>
