• Corey Minyard's avatar
    ipmi:ipmi_ipmb: Fix null-ptr-deref in ipmi_unregister_smi() · 9cc3aac4
    Corey Minyard authored
    KASAN report null-ptr-deref as follows:
    
    KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
    RIP: 0010:ipmi_unregister_smi+0x7d/0xd50 drivers/char/ipmi/ipmi_msghandler.c:3680
    Call Trace:
     ipmi_ipmb_remove+0x138/0x1a0 drivers/char/ipmi/ipmi_ipmb.c:443
     ipmi_ipmb_probe+0x409/0xda1 drivers/char/ipmi/ipmi_ipmb.c:548
     i2c_device_probe+0x959/0xac0 drivers/i2c/i2c-core-base.c:563
     really_probe+0x3f3/0xa70 drivers/base/dd.c:541
    
    In ipmi_ipmb_probe(), 'iidev->intf' is not set before
    ipmi_register_smi() success.  And in the error handling case,
    ipmi_ipmb_remove() is called to release resources, ipmi_unregister_smi()
    is called without check 'iidev->intf', this will cause KASAN
    null-ptr-deref issue.
    
    General kernel style is to allow NULL to be passed into unregister
    calls, so fix it that way.  This allows a NULL check to be removed in
    other code.
    
    Fixes: 57c9e3c9 ("ipmi:ipmi_ipmb: Unregister the SMI on remove")
    Reported-by: default avatarHulk Robot <hulkci@huawei.com>
    Cc: stable@vger.kernel.org # v5.17+
    Cc: Wei Yongjun <weiyongjun1@huawei.com>
    Signed-off-by: default avatarCorey Minyard <cminyard@mvista.com>
    9cc3aac4
ipmi_si_intf.c 58.6 KB