From: "Greg Kroah-Hartman (supporter:CHAR and MISC DRIVERS)" <gregkh@linuxfoundation.org>
To: Fred Klassen <fklassen@appneta.com>
Cc: "Corey Minyard (supporter:IPMI SUBSYSTEM)" <minyard@acm.org>,
"Arnd Bergmann (supporter:CHAR and MISC DRIVERS)" <arnd@arndb.de>,
"moderated list:IPMI SUBSYSTEM"
<openipmi-developer@lists.sourceforge.net>,
open list <linux-kernel@vger.kernel.org>,
stable@vger.kernel.org
Subject: Re: [PATCH] ipmi: Prevent use-after-free in deliver_response
Date: Sat, 19 Jan 2019 09:10:33 +0100 [thread overview]
Message-ID: <20190119081033.GA8103@kroah.com> (raw)
In-Reply-To: <09133030-238B-475F-94BC-B48827812714@appneta.com>
On Fri, Jan 18, 2019 at 03:10:39PM -0800, Fred Klassen wrote:
> Some IPMI modules (e.g. ibmpex_msg_handler()) will have ipmi_usr_hdlr
> handlers that call ipmi_free_recv_msg() directly. This will essentially
> kfree(msg), leading to use-after-free.
>
> This does not happen in the ipmi_devintf module, which will queue the
> message and run ipmi_free_recv_msg() later.
>
> BUG: KASAN: use-after-free in deliver_response+0x12f/0x1b0
> Read of size 8 at addr ffff888a7bf20018 by task ksoftirqd/3/27
> CPU: 3 PID: 27 Comm: ksoftirqd/3 Tainted: G O 4.19.11-amd64-ani99-debug #12.0.1.601133+pv
> Hardware name: AppNeta r1000/X11SPW-TF, BIOS 2.1a-AP 09/17/2018
> Call Trace:
> dump_stack+0x92/0xeb
> print_address_description+0x73/0x290
> kasan_report+0x258/0x380
> deliver_response+0x12f/0x1b0
> ? ipmi_free_recv_msg+0x50/0x50
> deliver_local_response+0xe/0x50
> handle_one_recv_msg+0x37a/0x21d0
> handle_new_recv_msgs+0x1ce/0x440
> ...
>
> Allocated by task 9885:
> kasan_kmalloc+0xa0/0xd0
> kmem_cache_alloc_trace+0x116/0x290
> ipmi_alloc_recv_msg+0x28/0x70
> i_ipmi_request+0xb4a/0x1640
> ipmi_request_settime+0x1b8/0x1e0
> ...
>
> Freed by task 27:
> __kasan_slab_free+0x12e/0x180
> kfree+0xe9/0x280
> deliver_response+0x122/0x1b0
> deliver_local_response+0xe/0x50
> handle_one_recv_msg+0x37a/0x21d0
> handle_new_recv_msgs+0x1ce/0x440
> tasklet_action_common.isra.19+0xc4/0x250
> __do_softirq+0x11f/0x51f
>
> Fixes: e86ee2d44b4 ("ipmi: Rework locking and shutdown for hot remove")
> Signed-off-by: Fred Klassen <fklassen@appneta.com>
>
> ---
> drivers/char/ipmi/ipmi_msghandler.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
<formletter>
This is not the correct way to submit patches for inclusion in the
stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.
</formletter>
prev parent reply other threads:[~2019-01-19 8:10 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-18 23:10 [PATCH] ipmi: Prevent use-after-free in deliver_response Fred Klassen
2019-01-19 8:10 ` Greg Kroah-Hartman (supporter:CHAR and MISC DRIVERS) [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190119081033.GA8103@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=arnd@arndb.de \
--cc=fklassen@appneta.com \
--cc=linux-kernel@vger.kernel.org \
--cc=minyard@acm.org \
--cc=openipmi-developer@lists.sourceforge.net \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.