iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5516e21a1e
linux/drivers/char/ipmi
History
John Garry 5516e21a1e ipmi: use dynamic memory for DMI driver override 
Currently a crash can be seen if we reach the "err"
label in dmi_add_platform_ipmi(), calling
platform_device_put(), like here:
[    7.270584]  (null): ipmi:dmi: Unable to add resources: -16
[    7.330229] ------------[ cut here ]------------
[    7.334889] kernel BUG at mm/slub.c:3894!
[    7.338936] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[    7.344475] Modules linked in:
[    7.347556] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc2-00004-gbe9cb7b-dirty #114
[    7.355907] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT17 Nemo 2.0 RC0 11/29/2017
[    7.365137] task: 00000000c211f6d3 task.stack: 00000000f276e9af
[    7.371116] pstate: 60000005 (nZCv daif -PAN -UAO)
[    7.375957] pc : kfree+0x194/0x1b4
[    7.379389] lr : platform_device_release+0xcc/0xd8
[    7.384225] sp : ffff0000092dba90
[    7.387567] x29: ffff0000092dba90 x28: ffff000008a83000
[    7.392933] x27: ffff0000092dbc10 x26: 00000000000000e6
[    7.398297] x25: 0000000000000003 x24: ffff0000085b51e8
[    7.403662] x23: 0000000000000100 x22: ffff7e0000234cc0
[    7.409027] x21: ffff000008af3660 x20: ffff8017d21acc10
[    7.414392] x19: ffff8017d21acc00 x18: 0000000000000002
[    7.419757] x17: 0000000000000001 x16: 0000000000000008
[    7.425121] x15: 0000000000000001 x14: 6666666678303d65
[    7.430486] x13: 6469727265766f5f x12: 7265766972642e76
[    7.435850] x11: 6564703e2d617020 x10: 6530326435373638
[    7.441215] x9 : 3030303030303030 x8 : 3d76656420657361
[    7.446580] x7 : ffff000008f59df8 x6 : ffff8017fbe0ea50
[    7.451945] x5 : 0000000000000000 x4 : 0000000000000000
[    7.457309] x3 : ffffffffffffffff x2 : 0000000000000000
[    7.462674] x1 : 0fffc00000000800 x0 : ffff7e0000234ce0
[    7.468039] Process swapper/0 (pid: 1, stack limit = 0x00000000f276e9af)
[    7.474809] Call trace:
[    7.477272]  kfree+0x194/0x1b4
[    7.480351]  platform_device_release+0xcc/0xd8
[    7.484837]  device_release+0x34/0x90
[    7.488531]  kobject_put+0x70/0xcc
[    7.491961]  put_device+0x14/0x1c
[    7.495304]  platform_device_put+0x14/0x1c
[    7.499439]  dmi_add_platform_ipmi+0x348/0x3ac
[    7.503923]  scan_for_dmi_ipmi+0xfc/0x10c
[    7.507970]  do_one_initcall+0x38/0x124
[    7.511840]  kernel_init_freeable+0x188/0x228
[    7.516238]  kernel_init+0x10/0x100
[    7.519756]  ret_from_fork+0x10/0x18
[    7.523362] Code: f94002c0 37780080 f94012c0 37000040 (d4210000)
[    7.529552] ---[ end trace 11750e4787deef9e ]---
[    7.534228] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[    7.534228]

This is because when the device is released in
platform_device_release(), we try to free
pdev.driver_override. This is a const string, hence
the crash.
Fix by using dynamic memory for pdev->driver_override.

Signed-off-by: John Garry <john.garry@huawei.com>
[Removed the free of driver_override from ipmi_si_remove_by_dev().  The
 free is done in platform_device_release(), and would result in a double
 free, and ipmi_si_remove_by_dev() is called by non-platform devices.]
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Cc: <stable@vger.kernel.org> # 4.14+
2018-01-22 08:07:54 -06:00
..
bt-bmc.c treewide: setup_timer() -> timer_setup() 2017-11-21 15:57:07 -08:00
ipmi_bt_sm.c ipmi: Make some data const that was only read 2015-09-03 15:02:27 -05:00
ipmi_devintf.c ipmi: get rid of field-by-field __get_user() 2017-06-26 17:02:54 -04:00
ipmi_dmi.c ipmi: use dynamic memory for DMI driver override 2018-01-22 08:07:54 -06:00
ipmi_dmi.h IPMI updates for 4.15 2017-11-15 15:12:28 -08:00
ipmi_kcs_sm.c ipmi: Make some data const that was only read 2015-09-03 15:02:27 -05:00
ipmi_msghandler.c ipmi: use correct string length 2018-01-08 20:02:47 -06:00
ipmi_powernv.c ipmi/ipmi_powernv: remove outdated todo in powernv IPMI driver 2018-01-16 16:08:44 -06:00
ipmi_poweroff.c Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux into for-next 2017-11-02 11:19:15 -05:00
ipmi_si_hardcode.c ipmi_si: Move hardcode handling to a separate file. 2017-09-27 16:03:45 -05:00
ipmi_si_hotmod.c Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux into for-next 2017-11-02 11:19:15 -05:00
ipmi_si_intf.c ipmi: Clear smi_info->thread to prevent use-after-free during module unload 2018-01-15 18:34:34 -06:00
ipmi_si_mem_io.c ipmi_si: Move port and mem I/O handling to their own files 2017-09-28 12:26:00 -05:00
ipmi_si_parisc.c ipmi_si: fix crash on parisc 2017-12-11 07:43:26 -06:00
ipmi_si_pci.c ipmi_si: Fix oops with PCI devices 2017-12-11 07:42:50 -06:00
ipmi_si_platform.c ipmi_si_platform: Fix typo in parameter description 2017-12-12 07:00:01 -06:00
ipmi_si_port_io.c ipmi_si: Move port and mem I/O handling to their own files 2017-09-28 12:26:00 -05:00
ipmi_si_sm.h ipmi: Make the DMI probe into a generic platform probe 2017-09-28 12:26:03 -05:00
ipmi_si.h ipmi_si: Move port and mem I/O handling to their own files 2017-09-28 12:26:00 -05:00
ipmi_smic_sm.c ipmi: Make some data const that was only read 2015-09-03 15:02:27 -05:00
ipmi_ssif.c treewide: setup_timer() -> timer_setup() 2017-11-21 15:57:07 -08:00
ipmi_watchdog.c ipmi: use correct string length 2018-01-08 20:02:47 -06:00
Kconfig ipmi: Make the IPMI proc interface configurable 2017-09-28 12:26:03 -05:00
Makefile IPMI updates for 4.15 2017-11-15 15:12:28 -08:00