Messages in this thread Patch in this message |  | | From | Justin Ernst <> | Subject | [PATCH] Remove redundant cleanup in ipmi_register_smi | Date | Tue, 21 Aug 2018 10:25:34 -0500 |
| |
When ipmi_register_smi fails, it performs a small cleanup routine before returning its error value. In try_smi_init, on the condition that ipmi_register_smi fails, ipmi_unregister_smi is called. ipmi_unregister_smi performs the same cleanup routine as ipmi_register_smi. This results in a kernel NULL pointer dereference. Removing the cleanup routine in ipmi_register_smi results in proper cleanup of a ipmi_register_smi failure.
Cc: Corey Minyard <minyard@acm.org> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Jeremy Kerr <jk@ozlabs.org> Cc: openipmi-developer@lists.sourceforge.net Cc: linux-kernel@vger.kernel.org Cc: Russ Anderson <russ.anderson@hpe.com> Acked-by: Andrew Banman <abanman@hpe.com> Signed-off-by: Justin Ernst <justin.ernst@hpe.com> --- drivers/char/ipmi/ipmi_msghandler.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index 51832b8a2c62..3b0b50c4f064 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -3395,12 +3395,12 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, out: if (rv) { - ipmi_bmc_unregister(intf); - list_del_rcu(&intf->link); + /* + * ipmi_unregister_smi must be called to clean up after + * failure. We unlock the mutex to allow ipmi_unregister_smi + * to lock it and perform cleanup. + */ mutex_unlock(&ipmi_interfaces_mutex); - synchronize_srcu(&ipmi_interfaces_srcu); - cleanup_srcu_struct(&intf->users_srcu); - kref_put(&intf->refcount, intf_free); } else { /* * Keep memory order straight for RCU readers. Make -- 2.12.3
|  |