* [PATCH] Remove redundant cleanup in ipmi_register_smi
@ 2018-08-21 15:25 Justin Ernst
2018-08-22 16:27 ` Corey Minyard
0 siblings, 1 reply; 3+ messages in thread
From: Justin Ernst @ 2018-08-21 15:25 UTC (permalink / raw)
To: Corey Minyard
Cc: Justin Ernst, Arnd Bergmann, Greg Kroah-Hartman, Jeremy Kerr,
openipmi-developer, linux-kernel, Russ Anderson
When ipmi_register_smi fails, it performs a small cleanup routine
before returning its error value. In try_smi_init, on the condition that
ipmi_register_smi fails, ipmi_unregister_smi is called. ipmi_unregister_smi
performs the same cleanup routine as ipmi_register_smi. This results in
a kernel NULL pointer dereference. Removing the cleanup routine in
ipmi_register_smi results in proper cleanup of a ipmi_register_smi failure.
Cc: Corey Minyard <minyard@acm.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jeremy Kerr <jk@ozlabs.org>
Cc: openipmi-developer@lists.sourceforge.net
Cc: linux-kernel@vger.kernel.org
Cc: Russ Anderson <russ.anderson@hpe.com>
Acked-by: Andrew Banman <abanman@hpe.com>
Signed-off-by: Justin Ernst <justin.ernst@hpe.com>
---
drivers/char/ipmi/ipmi_msghandler.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 51832b8a2c62..3b0b50c4f064 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3395,12 +3395,12 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
out:
if (rv) {
- ipmi_bmc_unregister(intf);
- list_del_rcu(&intf->link);
+ /*
+ * ipmi_unregister_smi must be called to clean up after
+ * failure. We unlock the mutex to allow ipmi_unregister_smi
+ * to lock it and perform cleanup.
+ */
mutex_unlock(&ipmi_interfaces_mutex);
- synchronize_srcu(&ipmi_interfaces_srcu);
- cleanup_srcu_struct(&intf->users_srcu);
- kref_put(&intf->refcount, intf_free);
} else {
/*
* Keep memory order straight for RCU readers. Make
--
2.12.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] Remove redundant cleanup in ipmi_register_smi
2018-08-21 15:25 [PATCH] Remove redundant cleanup in ipmi_register_smi Justin Ernst
@ 2018-08-22 16:27 ` Corey Minyard
2018-08-22 16:51 ` Ernst, Justin
0 siblings, 1 reply; 3+ messages in thread
From: Corey Minyard @ 2018-08-22 16:27 UTC (permalink / raw)
To: Justin Ernst, Corey Minyard
Cc: Arnd Bergmann, Greg Kroah-Hartman, Jeremy Kerr,
openipmi-developer, linux-kernel, Russ Anderson
On 08/21/2018 10:25 AM, Justin Ernst wrote:
> When ipmi_register_smi fails, it performs a small cleanup routine
> before returning its error value. In try_smi_init, on the condition that
> ipmi_register_smi fails, ipmi_unregister_smi is called. ipmi_unregister_smi
> performs the same cleanup routine as ipmi_register_smi. This results in
> a kernel NULL pointer dereference. Removing the cleanup routine in
> ipmi_register_smi results in proper cleanup of a ipmi_register_smi failure.
This is almost certainly wrong. If ipmi_register_smi() fails, the
calling code shouldn't call
ipmi_unregister_smi().
However, I think I know what is going wrong. ipmi_register_smi() can
fail after the interface
is initialized, if so the registering code will think it is registered
and call ipmi_unregister_smi()
on a failure. I'll send a patch for this.
-corey
>
> Cc: Corey Minyard <minyard@acm.org>
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Jeremy Kerr <jk@ozlabs.org>
> Cc: openipmi-developer@lists.sourceforge.net
> Cc: linux-kernel@vger.kernel.org
> Cc: Russ Anderson <russ.anderson@hpe.com>
> Acked-by: Andrew Banman <abanman@hpe.com>
> Signed-off-by: Justin Ernst <justin.ernst@hpe.com>
> ---
> drivers/char/ipmi/ipmi_msghandler.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
> index 51832b8a2c62..3b0b50c4f064 100644
> --- a/drivers/char/ipmi/ipmi_msghandler.c
> +++ b/drivers/char/ipmi/ipmi_msghandler.c
> @@ -3395,12 +3395,12 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
>
> out:
> if (rv) {
> - ipmi_bmc_unregister(intf);
> - list_del_rcu(&intf->link);
> + /*
> + * ipmi_unregister_smi must be called to clean up after
> + * failure. We unlock the mutex to allow ipmi_unregister_smi
> + * to lock it and perform cleanup.
> + */
> mutex_unlock(&ipmi_interfaces_mutex);
> - synchronize_srcu(&ipmi_interfaces_srcu);
> - cleanup_srcu_struct(&intf->users_srcu);
> - kref_put(&intf->refcount, intf_free);
> } else {
> /*
> * Keep memory order straight for RCU readers. Make
^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: [PATCH] Remove redundant cleanup in ipmi_register_smi
2018-08-22 16:27 ` Corey Minyard
@ 2018-08-22 16:51 ` Ernst, Justin
0 siblings, 0 replies; 3+ messages in thread
From: Ernst, Justin @ 2018-08-22 16:51 UTC (permalink / raw)
To: minyard
Cc: Arnd Bergmann, Greg Kroah-Hartman, Jeremy Kerr,
openipmi-developer, linux-kernel, Anderson, Russ
> -----Original Message-----
> From: Corey Minyard [mailto:tcminyard@gmail.com]
> Sent: Wednesday, August 22, 2018 11:28 AM
> To: Ernst, Justin <justin.ernst@hpe.com>; Corey Minyard
> <minyard@acm.org>
> Cc: Arnd Bergmann <arnd@arndb.de>; Greg Kroah-Hartman
> <gregkh@linuxfoundation.org>; Jeremy Kerr <jk@ozlabs.org>; openipmi-
> developer@lists.sourceforge.net; linux-kernel@vger.kernel.org; Anderson,
> Russ <russ.anderson@hpe.com>
> Subject: Re: [PATCH] Remove redundant cleanup in ipmi_register_smi
>
> On 08/21/2018 10:25 AM, Justin Ernst wrote:
> > When ipmi_register_smi fails, it performs a small cleanup routine
> > before returning its error value. In try_smi_init, on the condition
> > that ipmi_register_smi fails, ipmi_unregister_smi is called.
> > ipmi_unregister_smi performs the same cleanup routine as
> > ipmi_register_smi. This results in a kernel NULL pointer dereference.
> > Removing the cleanup routine in ipmi_register_smi results in proper
> cleanup of a ipmi_register_smi failure.
>
> This is almost certainly wrong. If ipmi_register_smi() fails, the calling code
> shouldn't call ipmi_unregister_smi().
>
> However, I think I know what is going wrong. ipmi_register_smi() can fail
> after the interface is initialized, if so the registering code will think it is
> registered and call ipmi_unregister_smi() on a failure. I'll send a patch for
> this.
>
> -corey
Thanks for the reply Corey. I agree with what you have stated. I'll be watching for the patch.
-Justin
>
> >
> > Cc: Corey Minyard <minyard@acm.org>
> > Cc: Arnd Bergmann <arnd@arndb.de>
> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > Cc: Jeremy Kerr <jk@ozlabs.org>
> > Cc: openipmi-developer@lists.sourceforge.net
> > Cc: linux-kernel@vger.kernel.org
> > Cc: Russ Anderson <russ.anderson@hpe.com>
> > Acked-by: Andrew Banman <abanman@hpe.com>
> > Signed-off-by: Justin Ernst <justin.ernst@hpe.com>
> > ---
> > drivers/char/ipmi/ipmi_msghandler.c | 10 +++++-----
> > 1 file changed, 5 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/char/ipmi/ipmi_msghandler.c
> > b/drivers/char/ipmi/ipmi_msghandler.c
> > index 51832b8a2c62..3b0b50c4f064 100644
> > --- a/drivers/char/ipmi/ipmi_msghandler.c
> > +++ b/drivers/char/ipmi/ipmi_msghandler.c
> > @@ -3395,12 +3395,12 @@ int ipmi_register_smi(const struct
> > ipmi_smi_handlers *handlers,
> >
> > out:
> > if (rv) {
> > - ipmi_bmc_unregister(intf);
> > - list_del_rcu(&intf->link);
> > + /*
> > + * ipmi_unregister_smi must be called to clean up after
> > + * failure. We unlock the mutex to allow ipmi_unregister_smi
> > + * to lock it and perform cleanup.
> > + */
> > mutex_unlock(&ipmi_interfaces_mutex);
> > - synchronize_srcu(&ipmi_interfaces_srcu);
> > - cleanup_srcu_struct(&intf->users_srcu);
> > - kref_put(&intf->refcount, intf_free);
> > } else {
> > /*
> > * Keep memory order straight for RCU readers. Make
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-08-22 16:51 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-08-21 15:25 [PATCH] Remove redundant cleanup in ipmi_register_smi Justin Ernst
2018-08-22 16:27 ` Corey Minyard
2018-08-22 16:51 ` Ernst, Justin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.