summaryrefslogtreecommitdiff
path: root/drivers/char
diff options
context:
space:
mode:
authorMasamitsu Yamazaki <m-yamazaki@ah.jp.nec.com>2018-01-15 07:58:12 +0000
committerCorey Minyard <cminyard@mvista.com>2018-01-15 18:34:34 -0600
commitbd1c06a4f5e2b2c96b9ff09a13983efb2d013b18 (patch)
treee16878d2f5d00327bad77ef2b19325d53aeac386 /drivers/char
parent1b4254cee0643ae624d33481b5107b790ae581b9 (diff)
ipmi: Clear smi_info->thread to prevent use-after-free during module unload
During code inspection, I found an use-after-free possibility during unloading ipmi_si in the polling mode. If start_new_msg() is called after kthread_stop(), the function will try to wake up non-existing kthread using the dangling pointer. Possible scenario is when a new internal message is generated after ipmi_unregister_smi()[*1] and remains after stop_timer_and_thread() in clenaup_one_si() [*2]. Use-after-free could occur as follows depending on BMC replies. cleanup_one_si => ipmi_unregister_smi [*1] => stop_timer_and_thread => kthread_stop(smi_info->thread) [*2] => poll => smi_event_handler => start_new_msg => if (smi_info->thread) wake_up_process(smi_info->thread) <== use-after-free!! Although currently it seems no such message is generated in the polling mode, some changes might introduce that in thefuture. For example in the interrupt mode, disable_si_irq() does that at [*2]. So let's prevent such a critical issue possibility now. Signed-off-by: Yamazaki Masamitsu <m-yamazaki@ah.jp.nec.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
Diffstat (limited to 'drivers/char')
-rw-r--r--drivers/char/ipmi/ipmi_si_intf.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 7499b0cd8326..6768cb2dd740 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1938,8 +1938,10 @@ static void check_for_broken_irqs(struct smi_info *smi_info)
static inline void stop_timer_and_thread(struct smi_info *smi_info)
{
- if (smi_info->thread != NULL)
+ if (smi_info->thread != NULL) {
kthread_stop(smi_info->thread);
+ smi_info->thread = NULL;
+ }
smi_info->timer_can_start = false;
if (smi_info->timer_running)