diff options
| author |   Masamitsu Yamazaki <m-yamazaki@ah.jp.nec.com> | 2018-01-15 07:58:12 +0000 |
|---|---|---|
| committer |   Corey Minyard <cminyard@mvista.com> | 2018-01-15 18:34:34 -0600 |
| commit | bd1c06a4f5e2b2c96b9ff09a13983efb2d013b18 (patch) | |
| tree | e16878d2f5d00327bad77ef2b19325d53aeac386 /drivers/char | |
| parent | ipmi: use correct string length (diff) | |
| download | linux-dev-bd1c06a4f5e2b2c96b9ff09a13983efb2d013b18.tar.xz linux-dev-bd1c06a4f5e2b2c96b9ff09a13983efb2d013b18.zip | |
ipmi: Clear smi_info->thread to prevent use-after-free during module unload
During code inspection, I found an use-after-free possibility during unloading
ipmi_si in the polling mode.
If start_new_msg() is called after kthread_stop(), the function will try to
wake up non-existing kthread using the dangling pointer.
Possible scenario is when a new internal message is generated after
ipmi_unregister_smi()[*1] and remains after stop_timer_and_thread()
in clenaup_one_si() [*2].
Use-after-free could occur as follows depending on BMC replies.
cleanup_one_si
=> ipmi_unregister_smi
[*1]
=> stop_timer_and_thread
=> kthread_stop(smi_info->thread)
[*2]
=> poll
=> smi_event_handler
=> start_new_msg
=> if (smi_info->thread)
wake_up_process(smi_info->thread) <== use-after-free!!
Although currently it seems no such message is generated in the polling mode,
some changes might introduce that in thefuture. For example in the interrupt
mode, disable_si_irq() does that at [*2].
So let's prevent such a critical issue possibility now.
Signed-off-by: Yamazaki Masamitsu <m-yamazaki@ah.jp.nec.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/ipmi/ipmi_si_intf.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c index 7499b0cd8326..6768cb2dd740 100644 --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -1938,8 +1938,10 @@ static void check_for_broken_irqs(struct smi_info *smi_info) static inline void stop_timer_and_thread(struct smi_info *smi_info) { - if (smi_info->thread != NULL) + if (smi_info->thread != NULL) { kthread_stop(smi_info->thread); + smi_info->thread = NULL; + } smi_info->timer_can_start = false; if (smi_info->timer_running) |