linux-kernel - [PATCH v2 0/3] ipmi: Close the race between __scan_channels() and deliver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250930074239.2353-1-guojinhui.liam@bytedance.com>
Date: Tue, 30 Sep 2025 15:42:36 +0800
From: Jinhui Guo <guojinhui.liam@...edance.com>
To: corey@...yard.net
Cc: openipmi-developer@...ts.sourceforge.net,
	linux-kernel@...r.kernel.org,
	guojinhui.liam@...edance.com
Subject: [PATCH v2 0/3] ipmi: Close the race between __scan_channels() and deliver_response()

The command "ipmi -b -t" would occasionally fail:
  #ipmitool -b 6 -t 0x2c raw 0x6 0x01
  Unable to send command: Invalid argument
  Unable to send RAW command (channel=0x6 netfn=0x6 lun=0x0 cmd=0x1)

The race window between __scan_channels() and deliver_response() causes
the parameters of some channels to be set to 0.

Fix the race between __scan_channels() and deliver_response() with the
following changes.

1. Only assign intf->channel_list = intf->wchannels and set
   intf->channels_ready = true in channel_handler() after all channels_ready
   have been successfully scanned or after failing to send the IPMI
   request.
2. channel_handler() sets intf->channels_ready to true but no one clears
   it, preventing __scan_channels() from rescanning channels. When the BMC
   firmware changes a rescan is required. Allow it by clearing the flag
   before starting a new scan.
3. Channels remain static unless the BMC firmware changes. Skip channel
   rescan when no BMC firmware update has occurred.

v1: https://lore.kernel.org/all/20250929081602.1901-1-guojinhui.liam@bytedance.com/

Changelog in v1 -> v2 (suggested by corey):
 - Split the fix into three independent patches, each addressing a
   separate issue.
 - Clear intf->channels_ready only when the BMC firmware changes.

Jinhui Guo (3):
  ipmi: Fix the race between __scan_channels() and deliver_response()
  ipmi: Fix __scan_channels() failing to rescan channels
  ipmi: Skip channel scan if channels are already marked ready

 drivers/char/ipmi/ipmi_msghandler.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

-- 
2.20.1