mirror of
https://github.com/torvalds/linux
synced 2024-10-11 22:05:39 +00:00
bd1c06a4f5
During code inspection, I found an use-after-free possibility during unloading
ipmi_si in the polling mode.
If start_new_msg() is called after kthread_stop(), the function will try to
wake up non-existing kthread using the dangling pointer.
Possible scenario is when a new internal message is generated after
ipmi_unregister_smi()[*1] and remains after stop_timer_and_thread()
in clenaup_one_si() [*2].
Use-after-free could occur as follows depending on BMC replies.
cleanup_one_si
=> ipmi_unregister_smi
[*1]
=> stop_timer_and_thread
=> kthread_stop(smi_info->thread)
[*2]
=> poll
=> smi_event_handler
=> start_new_msg
=> if (smi_info->thread)
wake_up_process(smi_info->thread) <== use-after-free!!
Although currently it seems no such message is generated in the polling mode,
some changes might introduce that in thefuture. For example in the interrupt
mode, disable_si_irq() does that at [*2].
So let's prevent such a critical issue possibility now.
Signed-off-by: Yamazaki Masamitsu <m-yamazaki@ah.jp.nec.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
|
||
|---|---|---|
| .. | ||
| bt-bmc.c | ||
| ipmi_bt_sm.c | ||
| ipmi_devintf.c | ||
| ipmi_dmi.c | ||
| ipmi_dmi.h | ||
| ipmi_kcs_sm.c | ||
| ipmi_msghandler.c | ||
| ipmi_powernv.c | ||
| ipmi_poweroff.c | ||
| ipmi_si.h | ||
| ipmi_si_hardcode.c | ||
| ipmi_si_hotmod.c | ||
| ipmi_si_intf.c | ||
| ipmi_si_mem_io.c | ||
| ipmi_si_parisc.c | ||
| ipmi_si_pci.c | ||
| ipmi_si_platform.c | ||
| ipmi_si_port_io.c | ||
| ipmi_si_sm.h | ||
| ipmi_smic_sm.c | ||
| ipmi_ssif.c | ||
| ipmi_watchdog.c | ||
| Kconfig | ||
| Makefile | ||