9cc3aac425
KASAN report null-ptr-deref as follows:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:ipmi_unregister_smi+0x7d/0xd50 drivers/char/ipmi/ipmi_msghandler.c:3680
Call Trace:
ipmi_ipmb_remove+0x138/0x1a0 drivers/char/ipmi/ipmi_ipmb.c:443
ipmi_ipmb_probe+0x409/0xda1 drivers/char/ipmi/ipmi_ipmb.c:548
i2c_device_probe+0x959/0xac0 drivers/i2c/i2c-core-base.c:563
really_probe+0x3f3/0xa70 drivers/base/dd.c:541
In ipmi_ipmb_probe(), 'iidev->intf' is not set before
ipmi_register_smi() success. And in the error handling case,
ipmi_ipmb_remove() is called to release resources, ipmi_unregister_smi()
is called without check 'iidev->intf', this will cause KASAN
null-ptr-deref issue.
General kernel style is to allow NULL to be passed into unregister
calls, so fix it that way. This allows a NULL check to be removed in
other code.
Fixes:
|
||
---|---|---|
.. | ||
bt-bmc.c | ||
ipmb_dev_int.c | ||
ipmi_bt_sm.c | ||
ipmi_devintf.c | ||
ipmi_dmi.c | ||
ipmi_dmi.h | ||
ipmi_ipmb.c | ||
ipmi_kcs_sm.c | ||
ipmi_msghandler.c | ||
ipmi_plat_data.c | ||
ipmi_plat_data.h | ||
ipmi_powernv.c | ||
ipmi_poweroff.c | ||
ipmi_si_hardcode.c | ||
ipmi_si_hotmod.c | ||
ipmi_si_intf.c | ||
ipmi_si_mem_io.c | ||
ipmi_si_parisc.c | ||
ipmi_si_pci.c | ||
ipmi_si_platform.c | ||
ipmi_si_port_io.c | ||
ipmi_si_sm.h | ||
ipmi_si.h | ||
ipmi_smic_sm.c | ||
ipmi_ssif.c | ||
ipmi_watchdog.c | ||
Kconfig | ||
kcs_bmc_aspeed.c | ||
kcs_bmc_cdev_ipmi.c | ||
kcs_bmc_client.h | ||
kcs_bmc_device.h | ||
kcs_bmc_npcm7xx.c | ||
kcs_bmc_serio.c | ||
kcs_bmc.c | ||
kcs_bmc.h | ||
Makefile |