| From foo@baz Sun May 27 17:33:38 CEST 2018 |
| From: Kamlakant Patel <kamlakant.patel@cavium.com> |
| Date: Tue, 13 Mar 2018 16:32:27 +0530 |
| Subject: ipmi_ssif: Fix kernel panic at msg_done_handler |
| |
| From: Kamlakant Patel <kamlakant.patel@cavium.com> |
| |
| [ Upstream commit f002612b9d86613bc6fde0a444e0095225f6053e ] |
| |
| This happens when BMC doesn't return any data and the code is trying |
| to print the value of data[2]. |
| |
| Getting following crash: |
| [ 484.728410] Unable to handle kernel NULL pointer dereference at virtual address 00000002 |
| [ 484.736496] pgd = ffff0000094a2000 |
| [ 484.739885] [00000002] *pgd=00000047fcffe003, *pud=00000047fcffd003, *pmd=0000000000000000 |
| [ 484.748158] Internal error: Oops: 96000005 [#1] SMP |
| [...] |
| [ 485.101451] Call trace: |
| [...] |
| [ 485.188473] [<ffff000000a46e68>] msg_done_handler+0x668/0x700 [ipmi_ssif] |
| [ 485.195249] [<ffff000000a456b8>] ipmi_ssif_thread+0x110/0x128 [ipmi_ssif] |
| [ 485.202038] [<ffff0000080f1430>] kthread+0x108/0x138 |
| [ 485.206994] [<ffff0000080838e0>] ret_from_fork+0x10/0x30 |
| [ 485.212294] Code: aa1903e1 aa1803e0 b900227f 95fef6a5 (39400aa3) |
| |
| Adding a check to validate the data len before printing data[2] to fix this issue. |
| |
| Signed-off-by: Kamlakant Patel <kamlakant.patel@cavium.com> |
| Signed-off-by: Corey Minyard <cminyard@mvista.com> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/char/ipmi/ipmi_ssif.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/char/ipmi/ipmi_ssif.c |
| +++ b/drivers/char/ipmi/ipmi_ssif.c |
| @@ -761,7 +761,7 @@ static void msg_done_handler(struct ssif |
| ssif_info->ssif_state = SSIF_NORMAL; |
| ipmi_ssif_unlock_cond(ssif_info, flags); |
| pr_warn(PFX "Error getting flags: %d %d, %x\n", |
| - result, len, data[2]); |
| + result, len, (len >= 3) ? data[2] : 0); |
| } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 |
| || data[1] != IPMI_GET_MSG_FLAGS_CMD) { |
| /* |
| @@ -783,7 +783,7 @@ static void msg_done_handler(struct ssif |
| if ((result < 0) || (len < 3) || (data[2] != 0)) { |
| /* Error clearing flags */ |
| pr_warn(PFX "Error clearing flags: %d %d, %x\n", |
| - result, len, data[2]); |
| + result, len, (len >= 3) ? data[2] : 0); |
| } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 |
| || data[1] != IPMI_CLEAR_MSG_FLAGS_CMD) { |
| pr_warn(PFX "Invalid response clearing flags: %x %x\n", |