Yang Yingliang 401e7e88d4 ipmi_si: fix use-after-free of resource->name ... When we excute the following commands, we got oops rmmod ipmi_si cat /proc/ioports [ 1623.482380] Unable to handle kernel paging request at virtual address ffff00000901d478 [ 1623.482382] Mem abort info: [ 1623.482383] ESR = 0x96000007 [ 1623.482385] Exception class = DABT (current EL), IL = 32 bits [ 1623.482386] SET = 0, FnV = 0 [ 1623.482387] EA = 0, S1PTW = 0 [ 1623.482388] Data abort info: [ 1623.482389] ISV = 0, ISS = 0x00000007 [ 1623.482390] CM = 0, WnR = 0 [ 1623.482393] swapper pgtable: 4k pages, 48-bit VAs, pgdp = 00000000d7d94a66 [ 1623.482395] [ffff00000901d478] pgd=000000dffbfff003, pud=000000dffbffe003, pmd=0000003f5d06e003, pte=0000000000000000 [ 1623.482399] Internal error: Oops: 96000007 [#1] SMP [ 1623.487407] Modules linked in: ipmi_si(E) nls_utf8 isofs rpcrdma ib_iser ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib rdma_ucm ib_umad rdma_cm ib_cm dm_mirror dm_region_hash dm_log iw_cm dm_mod aes_ce_blk crypto_simd cryptd aes_ce_cipher ses ghash_ce sha2_ce enclosure sha256_arm64 sg sha1_ce hisi_sas_v2_hw hibmc_drm sbsa_gwdt hisi_sas_main ip_tables mlx5_ib ib_uverbs marvell ib_core mlx5_core ixgbe mdio hns_dsaf ipmi_devintf hns_enet_drv ipmi_msghandler hns_mdio [last unloaded: ipmi_si] [ 1623.532410] CPU: 30 PID: 11438 Comm: cat Kdump: loaded Tainted: G E 5.0.0-rc3+ #168 [ 1623.541498] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.37 11/21/2017 [ 1623.548822] pstate: a0000005 (NzCv daif -PAN -UAO) [ 1623.553684] pc : string+0x28/0x98 [ 1623.557040] lr : vsnprintf+0x368/0x5e8 [ 1623.560837] sp : ffff000013213a80 [ 1623.564191] x29: ffff000013213a80 x28: ffff00001138abb5 [ 1623.569577] x27: ffff000013213c18 x26: ffff805f67d06049 [ 1623.574963] x25: 0000000000000000 x24: ffff00001138abb5 [ 1623.580349] x23: 0000000000000fb7 x22: ffff0000117ed000 [ 1623.585734] x21: ffff000011188fd8 x20: ffff805f67d07000 [ 1623.591119] x19: ffff805f67d06061 x18: ffffffffffffffff [ 1623.596505] x17: 0000000000000200 x16: 0000000000000000 [ 1623.601890] x15: ffff0000117ed748 x14: ffff805f67d07000 [ 1623.607276] x13: ffff805f67d0605e x12: 0000000000000000 [ 1623.612661] x11: 0000000000000000 x10: 0000000000000000 [ 1623.618046] x9 : 0000000000000000 x8 : 000000000000000f [ 1623.623432] x7 : ffff805f67d06061 x6 : fffffffffffffffe [ 1623.628817] x5 : 0000000000000012 x4 : ffff00000901d478 [ 1623.634203] x3 : ffff0a00ffffff04 x2 : ffff805f67d07000 [ 1623.639588] x1 : ffff805f67d07000 x0 : ffffffffffffffff [ 1623.644974] Process cat (pid: 11438, stack limit = 0x000000008d4cbc10) [ 1623.651592] Call trace: [ 1623.654068] string+0x28/0x98 [ 1623.657071] vsnprintf+0x368/0x5e8 [ 1623.660517] seq_vprintf+0x70/0x98 [ 1623.668009] seq_printf+0x7c/0xa0 [ 1623.675530] r_show+0xc8/0xf8 [ 1623.682558] seq_read+0x330/0x440 [ 1623.689877] proc_reg_read+0x78/0xd0 [ 1623.697346] __vfs_read+0x60/0x1a0 [ 1623.704564] vfs_read+0x94/0x150 [ 1623.711339] ksys_read+0x6c/0xd8 [ 1623.717939] __arm64_sys_read+0x24/0x30 [ 1623.725077] el0_svc_common+0x120/0x148 [ 1623.732035] el0_svc_handler+0x30/0x40 [ 1623.738757] el0_svc+0x8/0xc [ 1623.744520] Code: d1000406 aa0103e2 54000149 b4000080 (39400085) [ 1623.753441] ---[ end trace f91b6a4937de9835 ]--- [ 1623.760871] Kernel panic - not syncing: Fatal exception [ 1623.768935] SMP: stopping secondary CPUs [ 1623.775718] Kernel Offset: disabled [ 1623.781998] CPU features: 0x002,21006008 [ 1623.788777] Memory Limit: none [ 1623.798329] Starting crashdump kernel... [ 1623.805202] Bye! If io_setup is called successful in try_smi_init() but try_smi_init() goes out_err before calling ipmi_register_smi(), so ipmi_unregister_smi() will not be called while removing module. It leads to the resource that allocated in io_setup() can not be freed, but the name(DEVICE_NAME) of resource is freed while removing the module. It causes use-after-free when cat /proc/ioports. Fix this by calling io_cleanup() while try_smi_init() goes to out_err. and don't call io_cleanup() until io_setup() returns successful to avoid warning prints. Fixes: 93c303d204 ("ipmi_si: Clean up shutdown a bit") Cc: stable@vger.kernel.org Reported-by: NuoHan Qiao <qiaonuohan@huawei.com> Suggested-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>		2019-02-09 19:48:41 -06:00
..
accessibility
acpi	ACPI: Set debug output flags independent of ACPICA	2019-02-07 12:24:28 +01:00
amba
android	binderfs: remove separate device_initcall()	2019-02-01 15:50:26 +01:00
ata	libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD	2019-02-06 12:47:09 -07:00
atm	atm: he: fix sign-extension overflow on large shift	2019-01-17 11:27:00 -08:00
auxdisplay	auxdisplay: charlcd: fix x/y command parsing	2018-12-21 21:27:21 +01:00
base	Driver core fixes for 5.0-rc6	2019-02-08 10:53:44 -08:00
bcma
block	for-linus-20190118	2019-01-20 09:12:50 +12:00
bluetooth	Bluetooth: hci_bcm: Handle specific unknown packets after firmware loading	2018-12-19 13:43:42 +01:00
bus	ARM: SoC driver updates	2018-12-31 17:32:35 -08:00
cdrom	gdrom: fix a memory leak bug	2018-12-29 08:20:44 -07:00
char	ipmi_si: fix use-after-free of resource->name	2019-02-09 19:48:41 -06:00
clk	clk: qcom: gcc: Use active only source for CPUSS clocks	2019-01-24 11:41:48 -08:00
clocksource	arch/csky patches for 4.21-rc1	2019-01-05 09:50:07 -08:00
connector
cpufreq	Merge branches 'pm-cpuidle', 'pm-cpufreq' and 'pm-sleep'	2019-01-11 10:09:51 +01:00
cpuidle	cpuidle: poll_state: Fix default time limit	2019-01-30 22:57:42 +01:00
crypto	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2019-01-31 23:09:00 -08:00
dax	mm, devm_memremap_pages: fix shutdown handling	2018-12-28 12:11:47 -08:00
dca
devfreq	PM / devfreq: add devfreq_suspend/resume() functions	2018-12-11 11:40:13 +09:00
dio
dma	cross-tree: phase out dma_zalloc_coherent()	2019-01-08 07:58:37 -05:00
dma-buf	drivers/dma-buf/udmabuf.c: convert to use vm_fault_t	2019-01-04 13:13:46 -08:00
edac	EDAC, altera: Fix S10 persistent register offset	2019-01-24 17:13:59 +01:00
eisa
extcon
firewire	scsi: communicate max segment size to the DMA mapping code	2019-01-22 20:40:59 -05:00
firmware	ARM: SoC fixes for linux-5.0	2019-02-08 16:23:41 -08:00
fmc
fpga	fpga: stratix10-soc: fix wrong of_node_put() in init function	2019-01-31 16:19:48 +01:00
fsi
gnss	Merge 4.20-rc6 into tty-next	2018-12-10 10:17:45 +01:00
gpio	gpio: vf610: Mask all GPIO interrupts	2019-01-28 15:28:43 +01:00
gpu	drm-misc-fixes for v5.0-rc6:	2019-02-08 10:32:49 +10:00
hid	HID: debug: fix the ring buffer implementation	2019-01-29 12:09:11 +01:00
hsi
hv	vmbus: fix subchannel removal	2019-01-09 19:20:31 -05:00
hwmon	hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table	2019-01-17 12:54:52 -08:00
hwspinlock	hwspinlock: fix return value check in stm32_hwspinlock_probe()	2019-01-03 11:42:10 -08:00
hwtracing	intel_th: msu: Fix an off-by-one in attribute store	2018-12-19 20:21:06 +01:00
i2c	i2c: omap: Use noirq system sleep pm ops to idle device for suspend	2019-02-05 13:13:20 +01:00
i3c	i3c: master: dw: fix deadlock	2019-01-26 11:14:25 +01:00
ide	ide: ensure atapi sense request aren't preempted	2019-01-31 08:25:09 -07:00
idle
iio	First set of IIO fixes for the 5.0 cycle.	2019-02-03 13:10:41 +01:00
infiniband	IB/uverbs: Fix OOPs in uverbs_user_mmap_disassociate	2019-01-29 13:57:22 -07:00
input	Mostly driver fixes, but there's a core framework fix in here too.	2019-01-31 23:22:57 -08:00
iommu	IOMMU Fix for Linux v5.0-rc5:	2019-02-08 15:34:10 -08:00
ipack
irqchip	xtensa fixes for v5.0-rc5	2019-02-01 16:56:30 -08:00
isdn	mISDN: fix a race in dev_expire_timer()	2019-02-05 16:39:29 -08:00
leds	leds: lp5523: fix a missing check of return value of lp55xx_read	2019-01-17 22:27:39 +01:00
lightnvm	lightnvm: pblk: fix use-after-free bug	2018-12-22 14:45:35 -07:00
macintosh	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
mailbox	mailbox: tegra-hsp: Use device-managed registration API	2018-12-21 22:31:26 -06:00
mcb
md	dm: don't use bio_trim() afterall	2019-02-06 17:24:37 -05:00
media	media: vim2m: only cancel work if it is for right context	2019-01-16 11:13:25 -05:00
memory	ARM: SoC: late updates	2019-01-05 11:30:37 -08:00
memstick	MMC core:	2018-12-28 16:52:18 -08:00
message	scsi: flip the default on use_clustering	2018-12-18 23:13:12 -05:00
mfd	mfd: Fix unmet dependency warning for MFD_TPS68470	2019-01-29 10:55:34 +01:00
misc	mic: vop: Fix crash on remove	2019-02-01 15:53:54 +01:00
mmc	mmc: mediatek: fix incorrect register setting of hs400_cmd_int_delay	2019-01-28 12:49:28 +01:00
mtd	mtd: rawnand: gpmi: fix MX28 bus master lockup problem	2019-02-06 09:39:22 +01:00
mux
net	net: dsa: b53: Fix for failure when irq is not defined in dt	2019-02-07 18:18:37 -08:00
nfc
ntb	cross-tree: phase out dma_zalloc_coherent()	2019-01-08 07:58:37 -05:00
nubus
nvdimm	libnvdimm/security: Require nvdimm_security_setup_events() to succeed	2019-01-21 09:57:43 -08:00
nvme	nvme-pci: fix rapid add remove sequence	2019-02-06 16:35:33 +01:00
nvmem
of	OF: properties: add missing of_node_put	2019-01-16 12:49:53 -06:00
opp	cpufreq: scpi/scmi: Fix freeing of dynamic OPPs	2019-01-04 12:19:40 +01:00
oprofile
parisc	Kconfig file consolidation for v4.21	2018-12-29 13:40:29 -08:00
parport
pci	pci-v5.0-fixes-4	2019-02-08 15:32:10 -08:00
pcmcia	Included in this update:	2019-01-05 11:23:17 -08:00
perf	drivers/perf: hisi: Fixup one DDRC PMU register offset	2019-01-04 10:13:27 +00:00
phy	USB/PHY fixes for 5.0-rc4	2019-01-25 12:57:09 -10:00
pinctrl	pinctrl: sunxi: Correct number of IRQ banks on H6 main pin controller	2019-01-22 10:52:39 +01:00
platform	platform/x86: Fix unmet dependency warning for SAMSUNG_Q10	2019-01-29 10:59:07 +01:00
pnp	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
power	power supply and reset changes for the v4.21 series	2018-12-28 20:22:45 -08:00
powercap
pps	Kconfig updates for v4.21	2018-12-29 13:03:29 -08:00
ps3
ptp	ptp: check that rsv field is zero in struct ptp_sys_offset_extended	2019-01-08 16:22:56 -05:00
pwm	pwm: imx: Add ipg clock operation	2018-12-24 12:06:56 +01:00
rapidio	cross-tree: phase out dma_zalloc_coherent()	2019-01-08 07:58:37 -05:00
ras	treewide: surround Kconfig file paths with double quotes	2018-12-22 00:25:54 +09:00
regulator	Merge remote-tracking branch 'regulator/topic/coupled' into regulator-next	2018-12-21 13:43:35 +00:00
remoteproc	virtio: don't allocate vqs when names[i] = NULL	2019-01-14 20:15:19 -05:00
reset	reset: uniphier-glue: Add AHCI reset control support in glue layer	2019-01-07 16:38:51 +01:00
rpmsg
rtc	RTC for 4.21	2019-01-01 13:24:31 -08:00
s390	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-08 11:21:54 -08:00
sbus	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next	2018-12-26 10:32:18 -08:00
scsi	SCSI fixes on 20190208	2019-02-08 15:37:17 -08:00
sfi
sh
siox
slimbus
sn
soc	soc/fsl fixes for v5.0	2019-01-30 11:14:04 +01:00
soundwire
spi	cross-tree: phase out dma_zalloc_coherent()	2019-01-08 07:58:37 -05:00
spmi
ssb
staging	Staging/IIO driver fixes for 5.0-rc6	2019-02-08 10:51:59 -08:00
target	scsi: target: make the pi_prot_format ConfigFS path readable	2019-02-04 21:40:32 -05:00
tc
tee	OP-TEE dynamic shm log message	2018-12-31 13:06:30 -08:00
thermal	Merge branch 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux	2019-01-23 16:23:41 +13:00
thunderbolt
tty	TTY/Serial fixes for 5.0-rc6	2019-02-08 10:49:55 -08:00
uio	Char/Misc driver patches for 4.21-rc1	2018-12-28 20:54:57 -08:00
usb	usb: typec: tcpm: Correct the PPS out_volt calculation	2019-01-31 09:14:00 +01:00
uwb
vfio	vfio-pci/nvlink2: Fix ancient gcc warnings	2019-01-23 08:20:43 -07:00
vhost	vhost: fix OOB in get_rx_bufs()	2019-01-28 22:53:09 -08:00
video	TTY/Serial driver fixes for 5.0-rc4	2019-01-25 12:58:40 -10:00
virt
virtio	virtio: drop internal struct from UAPI	2019-02-05 15:29:48 -05:00
visorbus
vlynq
vme
w1	treewide: surround Kconfig file paths with double quotes	2018-12-22 00:25:54 +09:00
watchdog	watchdog: tqmx86: Fix a couple IS_ERR() vs NULL bugs	2019-01-07 10:10:35 +01:00
xen	arm64/xen: fix xen-swiotlb cache flushing	2019-01-23 22:14:56 +01:00
zorro
Kconfig	Kconfig file consolidation for v4.21	2018-12-29 13:40:29 -08:00
Makefile