linux-kernel - [PATCH] Remove redundant cleanup in ipmi_register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180821152534.30367-1-justin.ernst@hpe.com>
Date:   Tue, 21 Aug 2018 10:25:34 -0500
From:   Justin Ernst <justin.ernst@....com>
To:     Corey Minyard <minyard@....org>
CC:     Justin Ernst <justin.ernst@....com>, Arnd Bergmann <arnd@...db.de>,
        "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
        Jeremy Kerr <jk@...abs.org>,
        <openipmi-developer@...ts.sourceforge.net>,
        <linux-kernel@...r.kernel.org>,
        Russ Anderson <russ.anderson@....com>
Subject: [PATCH] Remove redundant cleanup in ipmi_register_smi

When ipmi_register_smi fails, it performs a small cleanup routine
before returning its error value. In try_smi_init, on the condition that
ipmi_register_smi fails, ipmi_unregister_smi is called. ipmi_unregister_smi
performs the same cleanup routine as ipmi_register_smi. This results in
a kernel NULL pointer dereference. Removing the cleanup routine in
ipmi_register_smi results in proper cleanup of a ipmi_register_smi failure.

Cc: Corey Minyard <minyard@....org>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Jeremy Kerr <jk@...abs.org>
Cc: openipmi-developer@...ts.sourceforge.net
Cc: linux-kernel@...r.kernel.org
Cc: Russ Anderson <russ.anderson@....com>
Acked-by: Andrew Banman <abanman@....com>
Signed-off-by: Justin Ernst <justin.ernst@....com>
---
 drivers/char/ipmi/ipmi_msghandler.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 51832b8a2c62..3b0b50c4f064 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3395,12 +3395,12 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
 
  out:
 	if (rv) {
-		ipmi_bmc_unregister(intf);
-		list_del_rcu(&intf->link);
+		/*
+		 * ipmi_unregister_smi must be called to clean up after
+		 * failure. We unlock the mutex to allow ipmi_unregister_smi
+		 * to lock it and perform cleanup.
+		 */
 		mutex_unlock(&ipmi_interfaces_mutex);
-		synchronize_srcu(&ipmi_interfaces_srcu);
-		cleanup_srcu_struct(&intf->users_srcu);
-		kref_put(&intf->refcount, intf_free);
 	} else {
 		/*
 		 * Keep memory order straight for RCU readers.  Make
-- 
2.12.3