[PATCH 6.19 040/220] ipmi:msghandler: Handle error returns from the SMI sender

Greg Kroah-Hartman
2026-03-23T13:51:23Z

From: Corey Minyard <corey@minyard.net>

[ Upstream commit 62cd145453d577113f993efd025f258dd86aa183 ]

It used to be, until recently, that the sender operation on the low
level interfaces would not fail. That's not the case any more with
recent changes.

So check the return value from the sender operation, and propagate it
back up from there and handle the errors in all places.

Reported-by: Rafael J. Wysocki <rafael@kernel.org>
Fixes: bc3a9d217755 ("ipmi:si: Gracefully handle if the BMC is non-functional")
Cc: stable@vger.kernel.org # 4.18
Signed-off-by: Corey Minyard <corey@minyard.net>
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_msghandler.c | 100 ++++++++++++++++++++++++------------
1 file changed, 68 insertions(+), 32 deletions(-)

--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -1887,19 +1887,32 @@ static struct ipmi_smi_msg *smi_add_send
return smi_msg;
}

-static void smi_send(struct ipmi_smi *intf,
+static int smi_send(struct ipmi_smi *intf,
const struct ipmi_smi_handlers *handlers,
struct ipmi_smi_msg *smi_msg, int priority)
{
int run_to_completion = READ_ONCE(intf->run_to_completion);
unsigned long flags = 0;
+ int rv = 0;

ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
smi_msg = smi_add_send_msg(intf, smi_msg, priority);
ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);

- if (smi_msg)
- handlers->sender(intf->send_info, smi_msg);
+ if (smi_msg) {
+ rv = handlers->sender(intf->send_info, smi_msg);
+ if (rv) {
+ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
+ intf->curr_msg = NULL;
+ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
+ /*
+ * Something may have been added to the transmit
+ * queue, so schedule a check for that.
+ */
+ queue_work(system_wq, &intf->smi_work);
+ }
+ }
+ return rv;
}

static bool is_maintenance_mode_cmd(struct kernel_ipmi_msg *msg)
@@ -2312,6 +2325,7 @@ static int i_ipmi_request(struct ipmi_us
struct ipmi_recv_msg *recv_msg;
int run_to_completion = READ_ONCE(intf->run_to_completion);
int rv = 0;
+ bool in_seq_table = false;

if (supplied_recv) {
recv_msg = supplied_recv;
@@ -2365,33 +2379,50 @@ static int i_ipmi_request(struct ipmi_us
rv = i_ipmi_req_ipmb(intf, addr, msgid, msg, smi_msg, recv_msg,
source_address, source_lun,
retries, retry_time_ms);
+ in_seq_table = true;
} else if (is_ipmb_direct_addr(addr)) {
rv = i_ipmi_req_ipmb_direct(intf, addr, msgid, msg, smi_msg,
recv_msg, source_lun);
} else if (is_lan_addr(addr)) {
rv = i_ipmi_req_lan(intf, addr, msgid, msg, smi_msg, recv_msg,
source_lun, retries, retry_time_ms);
+ in_seq_table = true;
} else {
- /* Unknown address type. */
+ /* Unknown address type. */
ipmi_inc_stat(intf, sent_invalid_commands);
rv = -EINVAL;
}

- if (rv) {
-out_err:
- if (!supplied_smi)
- ipmi_free_smi_msg(smi_msg);
- if (!supplied_recv)
- ipmi_free_recv_msg(recv_msg);
- } else {
+ if (!rv) {
dev_dbg(intf->si_dev, "Send: %*ph\n",
smi_msg->data_size, smi_msg->data);

- smi_send(intf, intf->handlers, smi_msg, priority);
+ rv = smi_send(intf, intf->handlers, smi_msg, priority);
+ if (rv != IPMI_CC_NO_ERROR)
+ /* smi_send() returns an IPMI err, return a Linux one. */
+ rv = -EIO;
+ if (rv && in_seq_table) {
+ /*
+ * If it's in the sequence table, it will be
+ * retried later, so ignore errors.
+ */
+ rv = 0;
+ /* But we need to fix the timeout. */
+ intf_start_seq_timer(intf, smi_msg->msgid);
+ ipmi_free_smi_msg(smi_msg);
+ smi_msg = NULL;
+ }
}
+out_err:
if (!run_to_completion)
mutex_unlock(&intf->users_mutex);

+ if (rv) {
+ if (!supplied_smi)
+ ipmi_free_smi_msg(smi_msg);
+ if (!supplied_recv)
+ ipmi_free_recv_msg(recv_msg);
+ }
return rv;
}

@@ -3965,12 +3996,12 @@ static int handle_ipmb_get_msg_cmd(struc
dev_dbg(intf->si_dev, "Invalid command: %*ph\n",
msg->data_size, msg->data);

- smi_send(intf, intf->handlers, msg, 0);
- /*
- * We used the message, so return the value that
- * causes it to not be freed or queued.
- */
- rv = -1;
+ if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR)
+ /*
+ * We used the message, so return the value that
+ * causes it to not be freed or queued.
+ */
+ rv = -1;
} else if (!IS_ERR(recv_msg)) {
/* Extract the source address from the data. */
ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
@@ -4044,12 +4075,12 @@ static int handle_ipmb_direct_rcv_cmd(st
msg->data[4] = IPMI_INVALID_CMD_COMPLETION_CODE;
msg->data_size = 5;

- smi_send(intf, intf->handlers, msg, 0);
- /*
- * We used the message, so return the value that
- * causes it to not be freed or queued.
- */
- rv = -1;
+ if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR)
+ /*
+ * We used the message, so return the value that
+ * causes it to not be freed or queued.
+ */
+ rv = -1;
} else if (!IS_ERR(recv_msg)) {
/* Extract the source address from the data. */
daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr;
@@ -4189,7 +4220,7 @@ static int handle_lan_get_msg_cmd(struct
struct ipmi_smi_msg *msg)
{
struct cmd_rcvr *rcvr;
- int rv = 0;
+ int rv = 0; /* Free by default */
unsigned char netfn;
unsigned char cmd;
unsigned char chan;
@@ -4242,12 +4273,12 @@ static int handle_lan_get_msg_cmd(struct
dev_dbg(intf->si_dev, "Invalid command: %*ph\n",
msg->data_size, msg->data);

- smi_send(intf, intf->handlers, msg, 0);
- /*
- * We used the message, so return the value that
- * causes it to not be freed or queued.
- */
- rv = -1;
+ if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR)
+ /*
+ * We used the message, so return the value that
+ * causes it to not be freed or queued.
+ */
+ rv = -1;
} else if (!IS_ERR(recv_msg)) {
/* Extract the source address from the data. */
lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
@@ -5056,7 +5087,12 @@ static void check_msg_timeout(struct ipm
ipmi_inc_stat(intf,
retransmitted_ipmb_commands);

- smi_send(intf, intf->handlers, smi_msg, 0);
+ /* If this fails we'll retry later or timeout. */
+ if (smi_send(intf, intf->handlers, smi_msg, 0) != IPMI_CC_NO_ERROR) {
+ /* But fix the timeout. */
+ intf_start_seq_timer(intf, smi_msg->msgid);
+ ipmi_free_smi_msg(smi_msg);
+ }
} else
ipmi_free_smi_msg(smi_msg);