John Garry 5516e21a1e ipmi: use dynamic memory for DMI driver override ... Currently a crash can be seen if we reach the "err" label in dmi_add_platform_ipmi(), calling platform_device_put(), like here: [ 7.270584] (null): ipmi:dmi: Unable to add resources: -16 [ 7.330229] ------------[ cut here ]------------ [ 7.334889] kernel BUG at mm/slub.c:3894! [ 7.338936] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 7.344475] Modules linked in: [ 7.347556] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc2-00004-gbe9cb7b-dirty #114 [ 7.355907] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT17 Nemo 2.0 RC0 11/29/2017 [ 7.365137] task: 00000000c211f6d3 task.stack: 00000000f276e9af [ 7.371116] pstate: 60000005 (nZCv daif -PAN -UAO) [ 7.375957] pc : kfree+0x194/0x1b4 [ 7.379389] lr : platform_device_release+0xcc/0xd8 [ 7.384225] sp : ffff0000092dba90 [ 7.387567] x29: ffff0000092dba90 x28: ffff000008a83000 [ 7.392933] x27: ffff0000092dbc10 x26: 00000000000000e6 [ 7.398297] x25: 0000000000000003 x24: ffff0000085b51e8 [ 7.403662] x23: 0000000000000100 x22: ffff7e0000234cc0 [ 7.409027] x21: ffff000008af3660 x20: ffff8017d21acc10 [ 7.414392] x19: ffff8017d21acc00 x18: 0000000000000002 [ 7.419757] x17: 0000000000000001 x16: 0000000000000008 [ 7.425121] x15: 0000000000000001 x14: 6666666678303d65 [ 7.430486] x13: 6469727265766f5f x12: 7265766972642e76 [ 7.435850] x11: 6564703e2d617020 x10: 6530326435373638 [ 7.441215] x9 : 3030303030303030 x8 : 3d76656420657361 [ 7.446580] x7 : ffff000008f59df8 x6 : ffff8017fbe0ea50 [ 7.451945] x5 : 0000000000000000 x4 : 0000000000000000 [ 7.457309] x3 : ffffffffffffffff x2 : 0000000000000000 [ 7.462674] x1 : 0fffc00000000800 x0 : ffff7e0000234ce0 [ 7.468039] Process swapper/0 (pid: 1, stack limit = 0x00000000f276e9af) [ 7.474809] Call trace: [ 7.477272] kfree+0x194/0x1b4 [ 7.480351] platform_device_release+0xcc/0xd8 [ 7.484837] device_release+0x34/0x90 [ 7.488531] kobject_put+0x70/0xcc [ 7.491961] put_device+0x14/0x1c [ 7.495304] platform_device_put+0x14/0x1c [ 7.499439] dmi_add_platform_ipmi+0x348/0x3ac [ 7.503923] scan_for_dmi_ipmi+0xfc/0x10c [ 7.507970] do_one_initcall+0x38/0x124 [ 7.511840] kernel_init_freeable+0x188/0x228 [ 7.516238] kernel_init+0x10/0x100 [ 7.519756] ret_from_fork+0x10/0x18 [ 7.523362] Code: f94002c0 37780080 f94012c0 37000040 (d4210000) [ 7.529552] ---[ end trace 11750e4787deef9e ]--- [ 7.534228] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 7.534228] This is because when the device is released in platform_device_release(), we try to free pdev.driver_override. This is a const string, hence the crash. Fix by using dynamic memory for pdev->driver_override. Signed-off-by: John Garry <john.garry@huawei.com> [Removed the free of driver_override from ipmi_si_remove_by_dev(). The free is done in platform_device_release(), and would result in a double free, and ipmi_si_remove_by_dev() is called by non-platform devices.] Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: <stable@vger.kernel.org> # 4.14+		2018-01-22 08:07:54 -06:00
..
bt-bmc.c	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
ipmi_bt_sm.c	ipmi: Make some data const that was only read	2015-09-03 15:02:27 -05:00
ipmi_devintf.c	ipmi: get rid of field-by-field __get_user()	2017-06-26 17:02:54 -04:00
ipmi_dmi.c	ipmi: use dynamic memory for DMI driver override	2018-01-22 08:07:54 -06:00
ipmi_dmi.h	IPMI updates for 4.15	2017-11-15 15:12:28 -08:00
ipmi_kcs_sm.c	ipmi: Make some data const that was only read	2015-09-03 15:02:27 -05:00
ipmi_msghandler.c	ipmi: use correct string length	2018-01-08 20:02:47 -06:00
ipmi_powernv.c	ipmi/ipmi_powernv: remove outdated todo in powernv IPMI driver	2018-01-16 16:08:44 -06:00
ipmi_poweroff.c	Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux into for-next	2017-11-02 11:19:15 -05:00
ipmi_si_hardcode.c	ipmi_si: Move hardcode handling to a separate file.	2017-09-27 16:03:45 -05:00
ipmi_si_hotmod.c	Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux into for-next	2017-11-02 11:19:15 -05:00
ipmi_si_intf.c	ipmi: Clear smi_info->thread to prevent use-after-free during module unload	2018-01-15 18:34:34 -06:00
ipmi_si_mem_io.c	ipmi_si: Move port and mem I/O handling to their own files	2017-09-28 12:26:00 -05:00
ipmi_si_parisc.c	ipmi_si: fix crash on parisc	2017-12-11 07:43:26 -06:00
ipmi_si_pci.c	ipmi_si: Fix oops with PCI devices	2017-12-11 07:42:50 -06:00
ipmi_si_platform.c	ipmi_si_platform: Fix typo in parameter description	2017-12-12 07:00:01 -06:00
ipmi_si_port_io.c	ipmi_si: Move port and mem I/O handling to their own files	2017-09-28 12:26:00 -05:00
ipmi_si_sm.h	ipmi: Make the DMI probe into a generic platform probe	2017-09-28 12:26:03 -05:00
ipmi_si.h	ipmi_si: Move port and mem I/O handling to their own files	2017-09-28 12:26:00 -05:00
ipmi_smic_sm.c	ipmi: Make some data const that was only read	2015-09-03 15:02:27 -05:00
ipmi_ssif.c	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
ipmi_watchdog.c	ipmi: use correct string length	2018-01-08 20:02:47 -06:00
Kconfig	ipmi: Make the IPMI proc interface configurable	2017-09-28 12:26:03 -05:00
Makefile	IPMI updates for 4.15	2017-11-15 15:12:28 -08:00