From mboxrd@z Thu Jan 1 00:00:00 1970 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932201AbeAOIRu convert rfc822-to-8bit (ORCPT + 1 other); Mon, 15 Jan 2018 03:17:50 -0500 Received: from tyo161.gate.nec.co.jp ([114.179.232.161]:48787 "EHLO tyo161.gate.nec.co.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752416AbeAOIRt (ORCPT ); Mon, 15 Jan 2018 03:17:49 -0500 X-Greylist: delayed 820 seconds by postgrey-1.27 at vger.kernel.org; Mon, 15 Jan 2018 03:17:49 EST From: Masamitsu Yamazaki To: "minyard@acm.org" , "openipmi-developer@lists.sourceforge.net" CC: "linux-kernel@vger.kernel.org" , "Junichi Nomura" , Kiyoshi Ueda , Masamitsu Yamazaki Subject: [PATCH] ipmi: Clear smi_info->thread to prevent use-after-free during module unload Thread-Topic: [PATCH] ipmi: Clear smi_info->thread to prevent use-after-free during module unload Thread-Index: AQHTjdaXaR5RVzkYZkWpTWjeQKUzsg== Date: Mon, 15 Jan 2018 07:58:12 +0000 Message-ID: <20180115080427.GA29559@53Xg1.linux.bs1.fc.nec.co.jp> Accept-Language: ja-JP, en-US Content-Language: ja-JP X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.34.125.198] Content-Type: text/plain; charset="iso-2022-jp" Content-ID: Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 X-TM-AS-MML: disable Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: Subject:[PATCH] ipmi: Clear smi_info->thread to prevent use-after-free during module unload To: Corey Minyard To: openipmi-developer@lists.sourceforge.net Cc: linux-kernel@vger.kernel.org Cc: j-nomura@ce.jp.nec.com Cc: k-ueda@ct.jp.nec.com Cc: m-yamazaki@ah.jp.nec.com During code inspection, I found an use-after-free possibility during unloading ipmi_si in the polling mode. If start_new_msg() is called after kthread_stop(), the function will try to wake up non-existing kthread using the dangling pointer. Possible scenario is when a new internal message is generated after ipmi_unregister_smi()[*1] and remains after stop_timer_and_thread() in clenaup_one_si() [*2]. Use-after-free could occur as follows depending on BMC replies. cleanup_one_si => ipmi_unregister_smi [*1] => stop_timer_and_thread => kthread_stop(smi_info->thread) [*2] => poll => smi_event_handler => start_new_msg => if (smi_info->thread) wake_up_process(smi_info->thread) <== use-after-free!! Although currently it seems no such message is generated in the polling mode, some changes might introduce that in thefuture. For example in the interrupt mode, disable_si_irq() does that at [*2]. So let's prevent such a critical issue possibility now. Signed-off-by: Yamazaki Masamitsu diff -Nurp a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c --- a/drivers/char/ipmi/ipmi_si_intf.c 2018-01-09 13:40:14.624785104 +0900 +++ b/drivers/char/ipmi/ipmi_si_intf.c 2018-01-09 13:44:39.174780570 +0900 @@ -1938,8 +1938,10 @@ static void check_for_broken_irqs(struct static inline void stop_timer_and_thread(struct smi_info *smi_info) { - if (smi_info->thread != NULL) + if (smi_info->thread != NULL) { kthread_stop(smi_info->thread); + smi_info->thread = NULL; + } smi_info->timer_can_start = false; if (smi_info->timer_running)