Commit 9cc3aac4 authored by Corey Minyard's avatar Corey Minyard
Browse files

ipmi:ipmi_ipmb: Fix null-ptr-deref in ipmi_unregister_smi() 



KASAN report null-ptr-deref as follows:

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:ipmi_unregister_smi+0x7d/0xd50 drivers/char/ipmi/ipmi_msghandler.c:3680
Call Trace:
 ipmi_ipmb_remove+0x138/0x1a0 drivers/char/ipmi/ipmi_ipmb.c:443
 ipmi_ipmb_probe+0x409/0xda1 drivers/char/ipmi/ipmi_ipmb.c:548
 i2c_device_probe+0x959/0xac0 drivers/i2c/i2c-core-base.c:563
 really_probe+0x3f3/0xa70 drivers/base/dd.c:541

In ipmi_ipmb_probe(), 'iidev->intf' is not set before
ipmi_register_smi() success.  And in the error handling case,
ipmi_ipmb_remove() is called to release resources, ipmi_unregister_smi()
is called without check 'iidev->intf', this will cause KASAN
null-ptr-deref issue.

General kernel style is to allow NULL to be passed into unregister
calls, so fix it that way.  This allows a NULL check to be removed in
other code.

Fixes: 57c9e3c9 ("ipmi:ipmi_ipmb: Unregister the SMI on remove")
Reported-by: default avatarHulk Robot <hulkci@huawei.com>
Cc: stable@vger.kernel.org # v5.17+
Cc: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: default avatarCorey Minyard <cminyard@mvista.com>
parent 3d092ef0

drivers/char/ipmi/ipmi_msghandler.c

+4 −1
Original line number Diff line number Diff line
@@ -3677,8 +3677,11 @@ static void cleanup_smi_msgs(struct ipmi_smi *intf) 
void ipmi_unregister_smi(struct ipmi_smi *intf)

{

	struct ipmi_smi_watcher *w;

	int intf_num = intf->intf_num, index;

	int intf_num, index;



	if (!intf)

		return;

	intf_num = intf->intf_num;

	mutex_lock(&ipmi_interfaces_mutex);

	intf->intf_num = -1;

	intf->in_shutdown = true;

drivers/char/ipmi/ipmi_si_intf.c

+1 −4
Original line number Diff line number Diff line
@@ -2220,10 +2220,7 @@ static void cleanup_one_si(struct smi_info *smi_info) 
		return;



	list_del(&smi_info->link);



	if (smi_info->intf)

	ipmi_unregister_smi(smi_info->intf);



	kfree(smi_info);

}