iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/char
History
Corey Minyard 3b9a907223 ipmi: fix sleep-in-atomic in free_user at cleanup SRCU user->release_barrier 
free_user() could be called in atomic context.

This patch pushed the free operation off into a workqueue.

Example:

 BUG: sleeping function called from invalid context at kernel/workqueue.c:2856
 in_atomic(): 1, irqs_disabled(): 0, pid: 177, name: ksoftirqd/27
 CPU: 27 PID: 177 Comm: ksoftirqd/27 Not tainted 4.19.25-3 #1
 Hardware name: AIC 1S-HV26-08/MB-DPSB04-06, BIOS IVYBV060 10/21/2015
 Call Trace:
  dump_stack+0x5c/0x7b
  ___might_sleep+0xec/0x110
  __flush_work+0x48/0x1f0
  ? try_to_del_timer_sync+0x4d/0x80
  _cleanup_srcu_struct+0x104/0x140
  free_user+0x18/0x30 [ipmi_msghandler]
  ipmi_free_recv_msg+0x3a/0x50 [ipmi_msghandler]
  deliver_response+0xbd/0xd0 [ipmi_msghandler]
  deliver_local_response+0xe/0x30 [ipmi_msghandler]
  handle_one_recv_msg+0x163/0xc80 [ipmi_msghandler]
  ? dequeue_entity+0xa0/0x960
  handle_new_recv_msgs+0x15c/0x1f0 [ipmi_msghandler]
  tasklet_action_common.isra.22+0x103/0x120
  __do_softirq+0xf8/0x2d7
  run_ksoftirqd+0x26/0x50
  smpboot_thread_fn+0x11d/0x1e0
  kthread+0x103/0x140
  ? sort_range+0x20/0x20
  ? kthread_destroy_worker+0x40/0x40
  ret_from_fork+0x1f/0x40

Fixes: 77f8269606bf ("ipmi: fix use-after-free of user->release_barrier.rda")

Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Cc: stable@vger.kernel.org # 5.0
Cc: Yang Yingliang <yangyingliang@huawei.com>
2019-04-17 10:29:27 -05:00
..
agp
agp: efficeon: no need to set PG_reserved on GATT tables
2019-03-05 21:07:18 -08:00
hw_random
ARM: SoC driver updates for 5.1
2019-03-06 09:41:12 -08:00
ipmi
ipmi: fix sleep-in-atomic in free_user at cleanup SRCU user->release_barrier
2019-04-17 10:29:27 -05:00
mwave
char/mwave: fix potential Spectre v1 vulnerability
2019-01-18 16:42:05 +01:00
pcmcia
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
tpm
tpm: Fix the type of the return value in calc_tpm2_event_size()
2019-04-08 15:58:54 -07:00
xilinx_hwicap
…
xillybus
PCI: Add Altera vendor ID
2018-03-14 19:13:47 +01:00
adi.c
char: sparc64: Add privileged ADI driver
2018-06-05 11:24:55 -07:00
apm-emulation.c
proc: introduce proc_create_single{,_data}
2018-05-16 07:23:35 +02:00
applicom.c
applicom: Fix potential Spectre v1 vulnerabilities
2019-01-22 13:34:35 +01:00
applicom.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
bsr.c
…
ds1620.c
proc: introduce proc_create_single{,_data}
2018-05-16 07:23:35 +02:00
dsp56k.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
dtlk.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
efirtc.c
efirtc: remove unnecessary code efi_rtc_open & efi_rtc_close
2019-01-22 13:19:12 +01:00
hangcheck-timer.c
treewide: Switch DEFINE_TIMER callbacks to struct timer_list *
2017-11-21 15:57:05 -08:00
hpet.c
hpet: Use struct_size() in kzalloc()
2019-02-26 12:53:55 +01:00
Kconfig
tty: mark Siemens R3964 line discipline as BROKEN
2019-04-05 05:56:44 -10:00
lp.c
char: lp: mark expected switch fall-through
2019-02-13 19:45:57 +01:00
Makefile
char/generic_nvram: Remove as unused
2019-01-22 10:21:45 +01:00
mbcs.c
mbcs: add .owner to mbcs struct file_operations
2019-01-22 14:56:00 +01:00
mbcs.h
…
mem.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
misc.c
proc: introduce proc_create_seq{,_data}
2018-05-16 07:23:35 +02:00
mspec.c
char: mspec: change return type to vm_fault_t
2018-04-23 13:51:53 +02:00
nsc_gpio.c
…
nvram.c
powerpc: Adopt nvram module for PPC64
2019-01-22 10:21:45 +01:00
nwbutton.c
treewide: Switch DEFINE_TIMER callbacks to struct timer_list *
2017-11-21 15:57:05 -08:00
nwbutton.h
treewide: Switch DEFINE_TIMER callbacks to struct timer_list *
2017-11-21 15:57:05 -08:00
nwflash.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
pc8736x_gpio.c
…
powernv-op-panel.c
…
ppdev.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
ps3flash.c
…
random.c
crypto: chacha20-generic - refactor to allow varying number of rounds
2018-11-20 14:26:55 +08:00
raw.c
treewide: Use array_size() in vzalloc()
2018-06-12 16:19:22 -07:00
rtc.c
RTC for 4.21
2019-01-01 13:24:31 -08:00
scx200_gpio.c
…
snsc_event.c
…
snsc.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
snsc.h
…
sonypi.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
tb0219.c
…
tlclk.c
tlclk: clean an indentation issue, remove extraneous tabs
2018-11-11 12:58:27 -08:00
toshiba.c
proc: introduce proc_create_single{,_data}
2018-05-16 07:23:35 +02:00
ttyprintk.c
ttyprintk: make the printk log level configurable
2018-11-09 08:58:18 -08:00
uv_mmtimer.c
…
virtio_console.c
char: virtio: Change to use DEFINE_SHOW_ATTRIBUTE macro
2018-12-06 15:42:18 +01:00