Commit cca85f19 authored by Neelesh Gupta's avatar Neelesh Gupta Committed by Corey Minyard

ipmi/powernv: Fix potential invalid pointer dereference

If the OPAL call to receive the ipmi message fails, then we free up the
smi message and return. But, the driver still holds the reference to
old smi message in the 'cur_msg' which can potentially be accessed later
and freed again leading to kernel oops. To fix it up,

The kernel driver should reset the 'cur_msg' and send reply to the user
in addition to freeing the message.
Signed-off-by: default avatarNeelesh Gupta <neelegup@linux.vnet.ibm.com>

Fixed a checkpatch warning dealing with an else after a return.
Signed-off-by: default avatarCorey Minyard <cminyard@mvista.com>
parent 0fbcf4af
...@@ -143,8 +143,15 @@ static int ipmi_powernv_recv(struct ipmi_smi_powernv *smi) ...@@ -143,8 +143,15 @@ static int ipmi_powernv_recv(struct ipmi_smi_powernv *smi)
pr_devel("%s: -> %d (size %lld)\n", __func__, pr_devel("%s: -> %d (size %lld)\n", __func__,
rc, rc == 0 ? size : 0); rc, rc == 0 ? size : 0);
if (rc) { if (rc) {
/* If came via the poll, and response was not yet ready */
if (rc == OPAL_EMPTY) {
spin_unlock_irqrestore(&smi->msg_lock, flags);
return 0;
}
smi->cur_msg = NULL;
spin_unlock_irqrestore(&smi->msg_lock, flags); spin_unlock_irqrestore(&smi->msg_lock, flags);
ipmi_free_smi_msg(msg); send_error_reply(smi, msg, IPMI_ERR_UNSPECIFIED);
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment