The nd_pmem_notify() routine is called whenever an ARS (address-range-scrub) completes to communicate results to the per-namespace badblocks instances. When the namespace is in btt mode we crash because we do not allocate a struct pmem_device instance in that case. Resulting in the following crash signature: BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 IP: nd_pmem_notify+0x30/0xf0 [nd_pmem] Call Trace: nd_device_notify+0x40/0x50 child_notify+0x10/0x20 device_for_each_child+0x50/0x90 nd_region_notify+0x20/0x30 nd_device_notify+0x40/0x50 nvdimm_region_notify+0x27/0x30 acpi_nfit_scrub+0x341/0x590 [nfit] process_one_work+0x197/0x450 worker_thread+0x4e/0x4a0 kthread+0x109/0x140 Given that we don't even populate the btt badblocks instance, just return early and skip the device to region lookup. This is a simpler version of the original fix by Toshi [1]. [1]: https://patchwork.kernel.org/patch/9700055/ Cc: Vishal Verma <vishal.l.verma(a)intel.com&gt; Reported-by: Toshi Kani <toshi.kani(a)hpe.com&gt; Signed-off-by: Dan Williams <dan.j.williams(a)intel.com&gt; --- drivers/nvdimm/pmem.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c index 5b536be5a12e..ee6cd31dafcf 100644 --- a/drivers/nvdimm/pmem.c +++ b/drivers/nvdimm/pmem.c @@ -388,21 +388,21 @@ static void nd_pmem_shutdown(struct device *dev) static void nd_pmem_notify(struct device *dev, enum nvdimm_event event) { - struct pmem_device *pmem = dev_get_drvdata(dev); - struct nd_region *nd_region = to_region(pmem); resource_size_t offset = 0, end_trunc = 0; struct nd_namespace_common *ndns; struct nd_namespace_io *nsio; + struct nd_region *nd_region; + struct pmem_device *pmem; struct resource res; if (event != NVDIMM_REVALIDATE_POISON) return; - if (is_nd_btt(dev)) { - struct nd_btt *nd_btt = to_nd_btt(dev); + /* no badblocks instance to update in the btt case */ + if (is_nd_btt(dev)) + return; - ndns = nd_btt->ndns; - } else if (is_nd_pfn(dev)) { + if (is_nd_pfn(dev)) { struct nd_pfn *nd_pfn = to_nd_pfn(dev); struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb; @@ -415,6 +415,8 @@ static void nd_pmem_notify(struct device *dev, enum nvdimm_event event) nsio = to_nd_namespace_io(&ndns->dev); res.start = nsio->res.start + offset; res.end = nsio->res.end - end_trunc; + pmem = dev_get_drvdata(dev); + nd_region = to_region(pmem); nvdimm_badblocks_populate(nd_region, &pmem->bb, &res); }