leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
bd1c06a4f5
linux/drivers/char
History
Masamitsu Yamazaki bd1c06a4f5 ipmi: Clear smi_info->thread to prevent use-after-free during module unload 
During code inspection, I found an use-after-free possibility during unloading
ipmi_si in the polling mode.

If start_new_msg() is called after kthread_stop(), the function will try to
wake up non-existing kthread using the dangling pointer.

Possible scenario is when a new internal message is generated after
ipmi_unregister_smi()[*1] and remains after stop_timer_and_thread()
in clenaup_one_si() [*2].
Use-after-free could occur as follows depending on BMC replies.

  cleanup_one_si
    => ipmi_unregister_smi
       [*1]
    => stop_timer_and_thread
       => kthread_stop(smi_info->thread)
       [*2]
    => poll
       => smi_event_handler
          => start_new_msg
             => if (smi_info->thread)
                    wake_up_process(smi_info->thread) <== use-after-free!!

Although currently it seems no such message is generated in the polling mode,
some changes might introduce that in thefuture. For example in the interrupt
mode, disable_si_irq() does that at [*2].

So let's prevent such a critical issue possibility now.

Signed-off-by: Yamazaki Masamitsu <m-yamazaki@ah.jp.nec.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
2018-01-15 18:34:34 -06:00
..
agp License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hw_random Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2017-11-14 10:52:09 -08:00
ipmi ipmi: Clear smi_info->thread to prevent use-after-free during module unload 2018-01-15 18:34:34 -06:00
mwave char/mwave: make some arrays static const to make object code smaller 2017-07-17 17:23:16 +02:00
pcmcia Char/Misc patches for 4.15-rc1 2017-11-16 09:10:59 -08:00
tpm treewide: setup_timer() -> timer_setup() 2017-11-21 15:57:07 -08:00
xilinx_hwicap char: xilinx_hwicap: Fix warnings in the driver 2017-08-28 17:04:47 +02:00
xillybus
apm-emulation.c apm-emulation: move APM_MINOR_DEV to include/linux/miscdevice.h 2017-01-10 21:46:41 +01:00
applicom.c applicom: constify pci_device_id. 2017-08-28 17:11:28 +02:00
applicom.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
bfin-otp.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
bsr.c
ds1302.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ds1620.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
dsp56k.c format-security: move static strings to const 2017-05-08 17:15:14 -07:00
dtlk.c treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
efirtc.c
generic_nvram.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
hangcheck-timer.c treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
hpet.c hpet: Make cmd parameter of hpet_ioctl_common() unsigned 2017-03-17 15:10:49 +09:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
lp.c char: lp: fix possible integer overflow in lp_setup() 2017-05-16 23:05:20 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mbcs.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
mbcs.h
mem.c x86/mm: Limit mmap() of /dev/mem to valid physical addresses 2017-11-16 12:49:48 +01:00
misc.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mspec.c drivers, char: convert vma_data.refcnt from atomic_t to refcount_t 2017-03-23 13:57:19 +01:00
nsc_gpio.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
nvram.c
nwbutton.c treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
nwbutton.h treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
nwflash.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
pc8736x_gpio.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
powernv-op-panel.c
ppdev.c ppdev: remove unused ROUND_UP macro 2017-07-17 17:23:17 +02:00
ps3flash.c
random.c kmemcheck: remove annotations 2017-11-15 18:21:04 -08:00
raw.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
rtc.c treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
scx200_gpio.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
snsc_event.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h> 2017-03-02 08:42:29 +01:00
snsc.c sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h> 2017-03-02 08:42:32 +01:00
snsc.h
sonypi.c dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
tb0219.c mips: separate extable.h, switch module.h to it 2016-10-05 18:36:18 -04:00
tile-srom.c tile-srom: allow the driver to be built as a module 2016-11-10 15:18:56 +01:00
tlclk.c timer: Remove last user of TIMER_INITIALIZER 2017-10-05 15:01:18 +02:00
toshiba.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
ttyprintk.c ttyprintk: Neaten and simplify printing 2016-09-13 17:30:17 +02:00
uv_mmtimer.c
virtio_console.c dma-mapping updates for 4.14: 2017-09-12 13:30:06 -07:00