[Regression] [PATCH] nvme/core: Access to NULL pointer in sysfs

[Torsten Hilbrich]

Hello,

when updating my kernel to a v5.9-rc2-based build I noticed some kernel
crashes when accessing the reconnect_delay and ctrl_loss_tmo sysfs
properties.

The kernel logs are attached in:

- panic-2.log: For ctrl_loss_tmo
- panic-2.log: For reconnect_delay

It seems that for my NVME-based SSD the ctrl->opts member is NULL.

The attached patch nvme-core.patch adds the accordings checks:

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 154942fc64eb..4fa5cc317cf3 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3586,7 +3586,7 @@ static ssize_t nvme_ctrl_loss_tmo_show(struct
device *dev,
        struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
        struct nvmf_ctrl_options *opts = ctrl->opts;

-       if (ctrl->opts->max_reconnects == -1)
+       if (! opts || opts->max_reconnects == -1)
                return sprintf(buf, "off\n");
        return sprintf(buf, "%d\n",
                        opts->max_reconnects * opts->reconnect_delay);
@@ -3618,7 +3618,7 @@ static ssize_t
nvme_ctrl_reconnect_delay_show(struct device *dev,
 {
        struct nvme_ctrl *ctrl = dev_get_drvdata(dev);

-       if (ctrl->opts->reconnect_delay == -1)
+       if (! ctrl->opts || ctrl->opts->reconnect_delay == -1)
                return sprintf(buf, "off\n");
        return sprintf(buf, "%d\n", ctrl->opts->reconnect_delay);
 }

With regards,

	Torsten Hilbrich

-- 
Dipl.-Inform.
Torsten Hilbrich
Teamleiter Bereich Entwicklung
Abteilung Network & Client Security
Divison Public Authorities
secunet Security Networks AG
Konrad-Zuse-Platz 2-4
81829 München

Tel: +49-201-5454-3522
Fax: +49-201-5454-1327
torsten.hilbrich at secunet.com
www.secunet.com

______________________________________________________________________

secunet Security Networks AG
Sitz: Kurfürstenstraße 58, 45138 Essen, Deutschland
Amtsgericht Essen HRB 13615
Vorstand: Axel Deininger (Vors.), Torsten Henn, Dr. Kai Martius, Thomas
          Pleines
Aufsichtsratsvorsitzender: Ralf Wintergerst
______________________________________________________________________

-------------- next part --------------
A non-text attachment was scrubbed...
Name: panic-3.log
Type: text/x-log
Size: 68404 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-nvme/attachments/20200831/f51bbdef/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: panic-2.log
Type: text/x-log
Size: 68144 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-nvme/attachments/20200831/f51bbdef/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: nvme-core.patch
Type: text/x-patch
Size: 880 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-nvme/attachments/20200831/f51bbdef/attachment-0005.bin>