KASAN report null-ptr-deref as follows:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:ipmi_unregister_smi+0x7d/0xd50 drivers/char/ipmi/ipmi_msghandler.c:3680
Call Trace:
ipmi_ipmb_remove+0x138/0x1a0 drivers/char/ipmi/ipmi_ipmb.c:443
ipmi_ipmb_probe+0x409/0xda1 drivers/char/ipmi/ipmi_ipmb.c:548
i2c_device_probe+0x959/0xac0 drivers/i2c/i2c-core-base.c:563
really_probe+0x3f3/0xa70 drivers/base/dd.c:541
In ipmi_ipmb_probe(), 'iidev->intf' is not set before ipmi_register_smi() success.
And in the error handling case, ipmi_ipmb_remove() is called to release resources,
ipmi_unregister_smi() is called without check 'iidev->intf', this will cause KASAN
null-ptr-deref issue.
Fix by adding NULL check prior to calling ipmi_unregister_smi().
Fixes: 57c9e3c9a374 ("ipmi:ipmi_ipmb: Unregister the SMI on remove")
Reported-by: Hulk Robot <[email protected]>
Signed-off-by: Wei Yongjun <[email protected]>
---
drivers/char/ipmi/ipmi_ipmb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/char/ipmi/ipmi_ipmb.c b/drivers/char/ipmi/ipmi_ipmb.c
index b81b862532fb..ea8fdb5ecfc9 100644
--- a/drivers/char/ipmi/ipmi_ipmb.c
+++ b/drivers/char/ipmi/ipmi_ipmb.c
@@ -437,7 +437,8 @@ static int ipmi_ipmb_remove(struct i2c_client *client)
iidev->client = NULL;
ipmi_ipmb_stop_thread(iidev);
- ipmi_unregister_smi(iidev->intf);
+ if (iidev->intf)
+ ipmi_unregister_smi(iidev->intf);
return 0;
}
--
2.25.1