Fred Klassen 479d6b39b9 ipmi: Prevent use-after-free in deliver_response ... Some IPMI modules (e.g. ibmpex_msg_handler()) will have ipmi_usr_hdlr handlers that call ipmi_free_recv_msg() directly. This will essentially kfree(msg), leading to use-after-free. This does not happen in the ipmi_devintf module, which will queue the message and run ipmi_free_recv_msg() later. BUG: KASAN: use-after-free in deliver_response+0x12f/0x1b0 Read of size 8 at addr ffff888a7bf20018 by task ksoftirqd/3/27 CPU: 3 PID: 27 Comm: ksoftirqd/3 Tainted: G O 4.19.11-amd64-ani99-debug #12.0.1.601133+pv Hardware name: AppNeta r1000/X11SPW-TF, BIOS 2.1a-AP 09/17/2018 Call Trace: dump_stack+0x92/0xeb print_address_description+0x73/0x290 kasan_report+0x258/0x380 deliver_response+0x12f/0x1b0 ? ipmi_free_recv_msg+0x50/0x50 deliver_local_response+0xe/0x50 handle_one_recv_msg+0x37a/0x21d0 handle_new_recv_msgs+0x1ce/0x440 ... Allocated by task 9885: kasan_kmalloc+0xa0/0xd0 kmem_cache_alloc_trace+0x116/0x290 ipmi_alloc_recv_msg+0x28/0x70 i_ipmi_request+0xb4a/0x1640 ipmi_request_settime+0x1b8/0x1e0 ... Freed by task 27: __kasan_slab_free+0x12e/0x180 kfree+0xe9/0x280 deliver_response+0x122/0x1b0 deliver_local_response+0xe/0x50 handle_one_recv_msg+0x37a/0x21d0 handle_new_recv_msgs+0x1ce/0x440 tasklet_action_common.isra.19+0xc4/0x250 __do_softirq+0x11f/0x51f Fixes: e86ee2d44b ("ipmi: Rework locking and shutdown for hot remove") Cc: stable@vger.kernel.org # 4.18 Signed-off-by: Fred Klassen <fklassen@appneta.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>		2019-01-23 10:44:45 -06:00
..
agp	mm: convert totalram_pages and totalhigh_pages variables to atomic	2018-12-28 12:11:47 -08:00
hw_random	hwrng: bcm2835 - Switch to SPDX identifier	2018-11-16 14:11:04 +08:00
ipmi	ipmi: Prevent use-after-free in deliver_response	2019-01-23 10:44:45 -06:00
mwave	char/mwave: make some arrays static const to make object code smaller	2017-07-17 17:23:16 +02:00
pcmcia	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
tpm	tpm: add support for partial reads	2018-12-17 13:45:10 +02:00
xilinx_hwicap	char: xilinx_hwicap: Fix warnings in the driver	2017-08-28 17:04:47 +02:00
xillybus	PCI: Add Altera vendor ID	2018-03-14 19:13:47 +01:00
adi.c	char: sparc64: Add privileged ADI driver	2018-06-05 11:24:55 -07:00
apm-emulation.c	proc: introduce proc_create_single{,_data}	2018-05-16 07:23:35 +02:00
applicom.c	applicom: constify pci_device_id.	2017-08-28 17:11:28 +02:00
applicom.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
bsr.c	bsr: avoid format string leaking into device name	2014-07-09 16:59:15 -07:00
ds1620.c	proc: introduce proc_create_single{,_data}	2018-05-16 07:23:35 +02:00
dsp56k.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
dtlk.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
efirtc.c	proc: introduce proc_create_single{,_data}	2018-05-16 07:23:35 +02:00
generic_nvram.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
hangcheck-timer.c	treewide: Switch DEFINE_TIMER callbacks to struct timer_list *	2017-11-21 15:57:05 -08:00
hpet.c	hpet: remove redundant pointer hpet	2018-07-03 13:01:57 +02:00
Kconfig	ttyprintk: make the printk log level configurable	2018-11-09 08:58:18 -08:00
lp.c	char: lp: use new parport device model	2018-12-19 10:40:17 +01:00
Makefile	char: sparc64: Add privileged ADI driver	2018-06-05 11:24:55 -07:00
mbcs.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
mbcs.h
mem.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
misc.c	proc: introduce proc_create_seq{,_data}	2018-05-16 07:23:35 +02:00
mspec.c	char: mspec: change return type to vm_fault_t	2018-04-23 13:51:53 +02:00
nsc_gpio.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
nvram.c	proc: introduce proc_create_single{,_data}	2018-05-16 07:23:35 +02:00
nwbutton.c	treewide: Switch DEFINE_TIMER callbacks to struct timer_list *	2017-11-21 15:57:05 -08:00
nwbutton.h	treewide: Switch DEFINE_TIMER callbacks to struct timer_list *	2017-11-21 15:57:05 -08:00
nwflash.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
pc8736x_gpio.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
powernv-op-panel.c	powerpc/powernv: Add driver for operator panel on FSP machines	2016-06-29 17:33:46 +10:00
ppdev.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
ps3flash.c	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
random.c	crypto: chacha20-generic - refactor to allow varying number of rounds	2018-11-20 14:26:55 +08:00
raw.c	treewide: Use array_size() in vzalloc()	2018-06-12 16:19:22 -07:00
rtc.c	RTC for 4.21	2019-01-01 13:24:31 -08:00
scx200_gpio.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
snsc_event.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
snsc.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
snsc.h
sonypi.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
tb0219.c	mips: separate extable.h, switch module.h to it	2016-10-05 18:36:18 -04:00
tlclk.c	tlclk: clean an indentation issue, remove extraneous tabs	2018-11-11 12:58:27 -08:00
toshiba.c	proc: introduce proc_create_single{,_data}	2018-05-16 07:23:35 +02:00
ttyprintk.c	ttyprintk: make the printk log level configurable	2018-11-09 08:58:18 -08:00
uv_mmtimer.c
virtio_console.c	char: virtio: Change to use DEFINE_SHOW_ATTRIBUTE macro	2018-12-06 15:42:18 +01:00