linux-kernel - [PATCH] ipmi: Clear smi_info->thread to prevent use-after-free during module unload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180115080427.GA29559@53Xg1.linux.bs1.fc.nec.co.jp>
Date:   Mon, 15 Jan 2018 07:58:12 +0000
From:   Masamitsu Yamazaki <m-yamazaki@...jp.nec.com>
To:     "minyard@....org" <minyard@....org>,
        "openipmi-developer@...ts.sourceforge.net" 
        <openipmi-developer@...ts.sourceforge.net>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Junichi Nomura" <j-nomura@...jp.nec.com>,
        Kiyoshi Ueda <k-ueda@...jp.nec.com>,
        Masamitsu Yamazaki <m-yamazaki@...jp.nec.com>
Subject: [PATCH] ipmi: Clear smi_info->thread to prevent use-after-free
 during module unload

Subject:[PATCH] ipmi: Clear smi_info->thread to prevent use-after-free during module unload
To: Corey Minyard <minyard@....org>
To: openipmi-developer@...ts.sourceforge.net
Cc: linux-kernel@...r.kernel.org
Cc: j-nomura@...jp.nec.com
Cc: k-ueda@...jp.nec.com
Cc: m-yamazaki@...jp.nec.com

During code inspection, I found an use-after-free possibility during unloading
ipmi_si in the polling mode.

If start_new_msg() is called after kthread_stop(), the function will try to
wake up non-existing kthread using the dangling pointer.

Possible scenario is when a new internal message is generated after 
ipmi_unregister_smi()[*1] and remains after stop_timer_and_thread()
in clenaup_one_si() [*2].
Use-after-free could occur as follows depending on BMC replies.

  cleanup_one_si
    => ipmi_unregister_smi
       [*1]
    => stop_timer_and_thread
       => kthread_stop(smi_info->thread) 
       [*2]
    => poll
       => smi_event_handler
          => start_new_msg
             => if (smi_info->thread)
                    wake_up_process(smi_info->thread) <== use-after-free!!

Although currently it seems no such message is generated in the polling mode,
some changes might introduce that in thefuture. For example in the interrupt
mode, disable_si_irq() does that at [*2].

So let's prevent such a critical issue possibility now.

Signed-off-by: Yamazaki Masamitsu <m-yamazaki@...jp.nec.com>


diff -Nurp a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
--- a/drivers/char/ipmi/ipmi_si_intf.c	2018-01-09 13:40:14.624785104 +0900
+++ b/drivers/char/ipmi/ipmi_si_intf.c	2018-01-09 13:44:39.174780570 +0900
@@ -1938,8 +1938,10 @@ static void check_for_broken_irqs(struct
 
 static inline void stop_timer_and_thread(struct smi_info *smi_info)
 {
-	if (smi_info->thread != NULL)
+	if (smi_info->thread != NULL) {
 		kthread_stop(smi_info->thread);
+		smi_info->thread = NULL;
+	}
 
 	smi_info->timer_can_start = false;
 	if (smi_info->timer_running)