linux/drivers/char/ipmi
Corey Minyard 9cc3aac425 ipmi:ipmi_ipmb: Fix null-ptr-deref in ipmi_unregister_smi()
KASAN report null-ptr-deref as follows:

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:ipmi_unregister_smi+0x7d/0xd50 drivers/char/ipmi/ipmi_msghandler.c:3680
Call Trace:
 ipmi_ipmb_remove+0x138/0x1a0 drivers/char/ipmi/ipmi_ipmb.c:443
 ipmi_ipmb_probe+0x409/0xda1 drivers/char/ipmi/ipmi_ipmb.c:548
 i2c_device_probe+0x959/0xac0 drivers/i2c/i2c-core-base.c:563
 really_probe+0x3f3/0xa70 drivers/base/dd.c:541

In ipmi_ipmb_probe(), 'iidev->intf' is not set before
ipmi_register_smi() success.  And in the error handling case,
ipmi_ipmb_remove() is called to release resources, ipmi_unregister_smi()
is called without check 'iidev->intf', this will cause KASAN
null-ptr-deref issue.

General kernel style is to allow NULL to be passed into unregister
calls, so fix it that way.  This allows a NULL check to be removed in
other code.

Fixes: 57c9e3c9a3 ("ipmi:ipmi_ipmb: Unregister the SMI on remove")
Reported-by: Hulk Robot <hulkci@huawei.com>
Cc: stable@vger.kernel.org # v5.17+
Cc: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
2022-04-29 10:06:52 -05:00
..
bt-bmc.c ipmi: bt: Add ast2600 compatible string 2021-10-07 14:02:45 -05:00
ipmb_dev_int.c ipmi: remove open coded version of SMBus block write 2021-01-28 07:15:12 -06:00
ipmi_bt_sm.c ipmi: Clean up some printks 2020-09-15 09:57:45 -05:00
ipmi_devintf.c ipmi:devintf: Return a proper error when recv buffer too small 2021-10-05 06:54:16 -05:00
ipmi_dmi.c ipmi_si: Rework some include files 2019-08-02 07:25:03 -05:00
ipmi_dmi.h ipmi_si: Rework some include files 2019-08-02 07:25:03 -05:00
ipmi_ipmb.c ipmi:ipmb: Add the ability to have a separate slave and master device 2022-02-23 08:16:02 -06:00
ipmi_kcs_sm.c ipmi: Clean up some printks 2020-09-15 09:57:45 -05:00
ipmi_msghandler.c ipmi:ipmi_ipmb: Fix null-ptr-deref in ipmi_unregister_smi() 2022-04-29 10:06:52 -05:00
ipmi_plat_data.c ipmi: Handle device properties with software node API 2021-03-10 19:00:02 -06:00
ipmi_plat_data.h ipmi: Add the i2c-addr property for SSIF interfaces 2019-04-24 09:02:53 -05:00
ipmi_powernv.c ipmi:powernv: Convert ipmi_smi_t to struct ipmi_smi 2018-09-18 16:15:33 -05:00
ipmi_poweroff.c ipmi: Use more common logging styles 2018-09-18 16:15:33 -05:00
ipmi_si_hardcode.c ipmi_si: Join string literals back 2021-04-02 12:53:42 -05:00
ipmi_si_hotmod.c ipmi_si: Join string literals back 2021-04-02 12:53:42 -05:00
ipmi_si_intf.c ipmi:ipmi_ipmb: Fix null-ptr-deref in ipmi_unregister_smi() 2022-04-29 10:06:52 -05:00
ipmi_si_mem_io.c ipmi_si: Rework some include files 2019-08-02 07:25:03 -05:00
ipmi_si_parisc.c parisc: Make struct parisc_driver::remove() return void 2021-08-30 10:18:25 +02:00
ipmi_si_pci.c ipmi_si: Join string literals back 2021-04-02 12:53:42 -05:00
ipmi_si_platform.c parisc: Make struct parisc_driver::remove() return void 2021-08-30 10:18:25 +02:00
ipmi_si_port_io.c ipmi_si: Rework some include files 2019-08-02 07:25:03 -05:00
ipmi_si_sm.h ipmi_si: Rework some include files 2019-08-02 07:25:03 -05:00
ipmi_si.h parisc: Make struct parisc_driver::remove() return void 2021-08-30 10:18:25 +02:00
ipmi_smic_sm.c ipmi: Clean up some printks 2020-09-15 09:57:45 -05:00
ipmi_ssif.c ipmi: initialize len variable 2022-03-20 12:37:15 -05:00
ipmi_watchdog.c ipmi/watchdog: Constify ident 2022-01-17 09:10:46 -06:00
Kconfig ipmi: ipmb: fix dependencies to eliminate build error 2021-10-14 11:17:18 -05:00
kcs_bmc_aspeed.c ipmi: kcs: aspeed: Remove old bindings support 2022-02-28 10:30:14 -06:00
kcs_bmc_cdev_ipmi.c ipmi: kcs_bmc: Decouple the IPMI chardev from the core 2021-06-21 19:50:22 -05:00
kcs_bmc_client.h ipmi: kcs_bmc: Allow clients to control KCS IRQ state 2021-06-21 19:50:28 -05:00
kcs_bmc_device.h ipmi: kcs_bmc: Allow clients to control KCS IRQ state 2021-06-21 19:50:28 -05:00
kcs_bmc_npcm7xx.c ipmi: kcs_bmc: Enable IBF on open 2021-06-21 19:50:28 -05:00
kcs_bmc_serio.c ipmi: kcs_bmc: Fix a memory leak in the error handling path of 'kcs_bmc_serio_add_device()' 2021-10-29 07:23:59 -05:00
kcs_bmc.c ipmi: kcs_bmc: Enable IBF on open 2021-06-21 19:50:28 -05:00
kcs_bmc.h ipmi: kcs_bmc: Allow clients to control KCS IRQ state 2021-06-21 19:50:28 -05:00
Makefile ipmi:ipmb: Add initial support for IPMI over IPMB 2021-10-05 06:54:17 -05:00