nvme-hwmon: kmalloc the NVME SMART log buffer

Recent commit 680e640238b1 ("nvme: set dma alignment to dword") has
caused a regression on our platform.

It turned out that the nvme_get_log() method invocation caused the
nvme_hwmon_data structure instance corruption.  In particular the
nvme_hwmon_data.ctrl pointer was overwritten either with zeros or with
garbage.  After some research we discovered that the problem happened
even before the actual NVME DMA execution, but during the buffer mapping.
Since our platform is DMA-noncoherent, the mapping implied the cache-line
invalidations or write-backs depending on the DMA-direction parameter.
In case of the NVME SMART log getting the DMA was performed
from-device-to-memory, thus the cache-invalidation was activated during
the buffer mapping.  Since the log-buffer isn't cache-line aligned, the
cache-invalidation caused the neighbour data to be discarded.  The
neighbouring data turned to be the data surrounding the buffer in the
framework of the nvme_hwmon_data structure.

In order to fix that we need to make sure that the whole log-buffer is
defined within the cache-line-aligned memory region so the
cache-invalidation procedure wouldn't involve the adjacent data. One of
the option to guarantee that is to kmalloc the DMA-buffer [1]. Seeing the
rest of the NVME core driver prefer that method it has been chosen to fix
this problem too.

Note after a deeper researches we found out that the denoted commit wasn't
a root cause of the problem. It just revealed the invalidity by activating
the DMA-based NVME SMART log getting performed in the framework of the
NVME hwmon driver. The problem was here since the initial commit of the
driver.

[1] Documentation/core-api/dma-api-howto.rst

Fixes: 3d07746f4ac3 ("nvme: Add hardware monitoring support")
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Signed-off-by: Christoph Hellwig <hch@lst.de>

diff --git a/drivers/nvme/host/hwmon.c b/drivers/nvme/host/hwmon.c
index 23918bb7bdca2b1800dc8cabbd9d912845baa389..9e6e56c20ec993bfca3ee2eb18d2e371d7225230 100644 (file)
--- a/drivers/nvme/host/hwmon.c
+++ b/drivers/nvme/host/hwmon.c
@@ -12,7 +12,7 @@
 
 struct nvme_hwmon_data {
        struct nvme_ctrl *ctrl;
-       struct nvme_smart_log log;
+       struct nvme_smart_log *log;
        struct mutex read_lock;
 };
 
@@ -60,14 +60,14 @@ static int nvme_set_temp_thresh(struct nvme_ctrl *ctrl, int sensor, bool under,
 static int nvme_hwmon_get_smart_log(struct nvme_hwmon_data *data)
 {
        return nvme_get_log(data->ctrl, NVME_NSID_ALL, NVME_LOG_SMART, 0,
-                          NVME_CSI_NVM, &data->log, sizeof(data->log), 0);
+                          NVME_CSI_NVM, data->log, sizeof(*data->log), 0);
 }
 
 static int nvme_hwmon_read(struct device *dev, enum hwmon_sensor_types type,
                           u32 attr, int channel, long *val)
 {
        struct nvme_hwmon_data *data = dev_get_drvdata(dev);
-       struct nvme_smart_log *log = &data->log;
+       struct nvme_smart_log *log = data->log;
        int temp;
        int err;
 
@@ -163,7 +163,7 @@ static umode_t nvme_hwmon_is_visible(const void *_data,
        case hwmon_temp_max:
        case hwmon_temp_min:
                if ((!channel && data->ctrl->wctemp) ||
-                   (channel && data->log.temp_sensor[channel - 1])) {
+                   (channel && data->log->temp_sensor[channel - 1])) {
                        if (data->ctrl->quirks &
                            NVME_QUIRK_NO_TEMP_THRESH_CHANGE)
                                return 0444;
@@ -176,7 +176,7 @@ static umode_t nvme_hwmon_is_visible(const void *_data,
                break;
        case hwmon_temp_input:
        case hwmon_temp_label:
-               if (!channel || data->log.temp_sensor[channel - 1])
+               if (!channel || data->log->temp_sensor[channel - 1])
                        return 0444;
                break;
        default:
@@ -232,13 +232,19 @@ int nvme_hwmon_init(struct nvme_ctrl *ctrl)
        if (!data)
                return -ENOMEM;
 
+       data->log = kzalloc(sizeof(*data->log), GFP_KERNEL);
+       if (!data->log) {
+               err = -ENOMEM;
+               goto err_free_data;
+       }
+
        data->ctrl = ctrl;
        mutex_init(&data->read_lock);
 
        err = nvme_hwmon_get_smart_log(data);
        if (err) {
                dev_warn(dev, "Failed to read smart log (error %d)\n", err);
-               goto err_free_data;
+               goto err_free_log;
        }
 
        hwmon = hwmon_device_register_with_info(dev, "nvme",
@@ -247,11 +253,13 @@ int nvme_hwmon_init(struct nvme_ctrl *ctrl)
        if (IS_ERR(hwmon)) {
                dev_warn(dev, "Failed to instantiate hwmon device\n");
                err = PTR_ERR(hwmon);
-               goto err_free_data;
+               goto err_free_log;
        }
        ctrl->hwmon_device = hwmon;
        return 0;
 
+err_free_log:
+       kfree(data->log);
 err_free_data:
        kfree(data);
        return err;
@@ -265,6 +273,7 @@ void nvme_hwmon_exit(struct nvme_ctrl *ctrl)
 
                hwmon_device_unregister(ctrl->hwmon_device);
                ctrl->hwmon_device = NULL;
+               kfree(data->log);
                kfree(data);
        }
 }