Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Reply-To: minyard@acm.org
Subject: Re: [PATCH] Remove redundant cleanup in ipmi_register_smi
To:     Justin Ernst <justin.ernst@hpe.com>,
        Corey Minyard <minyard@acm.org>
Cc:     Arnd Bergmann <arnd@arndb.de>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Jeremy Kerr <jk@ozlabs.org>,
        openipmi-developer@lists.sourceforge.net,
        linux-kernel@vger.kernel.org, Russ Anderson <russ.anderson@hpe.com>
References: <20180821152534.30367-1-justin.ernst@hpe.com>
From:   Corey Minyard <tcminyard@gmail.com>
Message-ID: <42513566-6982-c9c4-dbbb-ed98bd332fe9@gmail.com>
Date:   Wed, 22 Aug 2018 11:27:39 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <20180821152534.30367-1-justin.ernst@hpe.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-GB
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 08/21/2018 10:25 AM, Justin Ernst wrote:
> When ipmi_register_smi fails, it performs a small cleanup routine
> before returning its error value. In try_smi_init, on the condition that
> ipmi_register_smi fails, ipmi_unregister_smi is called. ipmi_unregister_smi
> performs the same cleanup routine as ipmi_register_smi. This results in
> a kernel NULL pointer dereference. Removing the cleanup routine in
> ipmi_register_smi results in proper cleanup of a ipmi_register_smi failure.

This is almost certainly wrong.  If ipmi_register_smi() fails, the 
calling code shouldn't call
ipmi_unregister_smi().

However, I think I know what is going wrong.  ipmi_register_smi() can 
fail after the interface
is initialized, if so the registering code will think it is registered 
and call ipmi_unregister_smi()
on a failure.  I'll send a patch for this.

-corey

>
> Cc: Corey Minyard <minyard@acm.org>
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Jeremy Kerr <jk@ozlabs.org>
> Cc: openipmi-developer@lists.sourceforge.net
> Cc: linux-kernel@vger.kernel.org
> Cc: Russ Anderson <russ.anderson@hpe.com>
> Acked-by: Andrew Banman <abanman@hpe.com>
> Signed-off-by: Justin Ernst <justin.ernst@hpe.com>
> ---
>   drivers/char/ipmi/ipmi_msghandler.c | 10 +++++-----
>   1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
> index 51832b8a2c62..3b0b50c4f064 100644
> --- a/drivers/char/ipmi/ipmi_msghandler.c
> +++ b/drivers/char/ipmi/ipmi_msghandler.c
> @@ -3395,12 +3395,12 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
>   
>    out:
>   	if (rv) {
> -		ipmi_bmc_unregister(intf);
> -		list_del_rcu(&intf->link);
> +		/*
> +		 * ipmi_unregister_smi must be called to clean up after
> +		 * failure. We unlock the mutex to allow ipmi_unregister_smi
> +		 * to lock it and perform cleanup.
> +		 */
>   		mutex_unlock(&ipmi_interfaces_mutex);
> -		synchronize_srcu(&ipmi_interfaces_srcu);
> -		cleanup_srcu_struct(&intf->users_srcu);
> -		kref_put(&intf->refcount, intf_free);
>   	} else {
>   		/*
>   		 * Keep memory order straight for RCU readers.  Make