leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
479d6b39b9
linux/drivers/char
History
Fred Klassen 479d6b39b9 ipmi: Prevent use-after-free in deliver_response 
Some IPMI modules (e.g. ibmpex_msg_handler()) will have ipmi_usr_hdlr
handlers that call ipmi_free_recv_msg() directly. This will essentially
kfree(msg), leading to use-after-free.

This does not happen in the ipmi_devintf module, which will queue the
message and run ipmi_free_recv_msg() later.

BUG: KASAN: use-after-free in deliver_response+0x12f/0x1b0
Read of size 8 at addr ffff888a7bf20018 by task ksoftirqd/3/27
CPU: 3 PID: 27 Comm: ksoftirqd/3 Tainted: G           O      4.19.11-amd64-ani99-debug #12.0.1.601133+pv
Hardware name: AppNeta r1000/X11SPW-TF, BIOS 2.1a-AP 09/17/2018
Call Trace:
dump_stack+0x92/0xeb
print_address_description+0x73/0x290
kasan_report+0x258/0x380
deliver_response+0x12f/0x1b0
? ipmi_free_recv_msg+0x50/0x50
deliver_local_response+0xe/0x50
handle_one_recv_msg+0x37a/0x21d0
handle_new_recv_msgs+0x1ce/0x440
...

Allocated by task 9885:
kasan_kmalloc+0xa0/0xd0
kmem_cache_alloc_trace+0x116/0x290
ipmi_alloc_recv_msg+0x28/0x70
i_ipmi_request+0xb4a/0x1640
ipmi_request_settime+0x1b8/0x1e0
...

Freed by task 27:
__kasan_slab_free+0x12e/0x180
kfree+0xe9/0x280
deliver_response+0x122/0x1b0
deliver_local_response+0xe/0x50
handle_one_recv_msg+0x37a/0x21d0
handle_new_recv_msgs+0x1ce/0x440
tasklet_action_common.isra.19+0xc4/0x250
__do_softirq+0x11f/0x51f

Fixes: e86ee2d44b ("ipmi: Rework locking and shutdown for hot remove")
Cc: stable@vger.kernel.org # 4.18
Signed-off-by: Fred Klassen <fklassen@appneta.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
2019-01-23 10:44:45 -06:00
..
agp mm: convert totalram_pages and totalhigh_pages variables to atomic 2018-12-28 12:11:47 -08:00
hw_random hwrng: bcm2835 - Switch to SPDX identifier 2018-11-16 14:11:04 +08:00
ipmi ipmi: Prevent use-after-free in deliver_response 2019-01-23 10:44:45 -06:00
mwave char/mwave: make some arrays static const to make object code smaller 2017-07-17 17:23:16 +02:00
pcmcia Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
tpm tpm: add support for partial reads 2018-12-17 13:45:10 +02:00
xilinx_hwicap char: xilinx_hwicap: Fix warnings in the driver 2017-08-28 17:04:47 +02:00
xillybus PCI: Add Altera vendor ID 2018-03-14 19:13:47 +01:00
adi.c char: sparc64: Add privileged ADI driver 2018-06-05 11:24:55 -07:00
apm-emulation.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
applicom.c applicom: constify pci_device_id. 2017-08-28 17:11:28 +02:00
applicom.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
bsr.c
ds1620.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
dsp56k.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
dtlk.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
efirtc.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
generic_nvram.c Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
hangcheck-timer.c treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
hpet.c hpet: remove redundant pointer hpet 2018-07-03 13:01:57 +02:00
Kconfig ttyprintk: make the printk log level configurable 2018-11-09 08:58:18 -08:00
lp.c char: lp: use new parport device model 2018-12-19 10:40:17 +01:00
Makefile char: sparc64: Add privileged ADI driver 2018-06-05 11:24:55 -07:00
mbcs.c
mbcs.h
mem.c Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
misc.c proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
mspec.c char: mspec: change return type to vm_fault_t 2018-04-23 13:51:53 +02:00
nsc_gpio.c
nvram.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
nwbutton.c treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
nwbutton.h treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
nwflash.c Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
pc8736x_gpio.c
powernv-op-panel.c
ppdev.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
ps3flash.c
random.c crypto: chacha20-generic - refactor to allow varying number of rounds 2018-11-20 14:26:55 +08:00
raw.c treewide: Use array_size() in vzalloc() 2018-06-12 16:19:22 -07:00
rtc.c RTC for 4.21 2019-01-01 13:24:31 -08:00
scx200_gpio.c
snsc_event.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h> 2017-03-02 08:42:29 +01:00
snsc.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
snsc.h
sonypi.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
tb0219.c
tlclk.c tlclk: clean an indentation issue, remove extraneous tabs 2018-11-11 12:58:27 -08:00
toshiba.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
ttyprintk.c ttyprintk: make the printk log level configurable 2018-11-09 08:58:18 -08:00
uv_mmtimer.c
virtio_console.c char: virtio: Change to use DEFINE_SHOW_ATTRIBUTE macro 2018-12-06 15:42:18 +01:00