In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipmi: si: Fix NULL pointer dereference after failed registration<\/p>\n
try_smi_init() allocates new_smi->si_sm and later calls
\nipmi_register_smi_mod(), which maps to ipmi_add_smi().<\/p>\n
During ipmi_add_smi(), the upper IPMI message handler obtains the
\ninitial BMC device information through __bmc_get_device_id(). This can
\nfail if the BMC does not return a successful response to the Get Device
\nID command.<\/p>\n
When the BMC returns a nonzero completion code, the device-id helper
\nretries the command and eventually returns -EIO if the device ID still
\ncannot be fetched.<\/p>\n
On this failure path, ipmi_add_smi() logs “Unable to get the device id”
\nand goes to out_err_started, where it invokes the lower driver’s
\nshutdown callback. try_smi_init() then logs the returned registration
\nfailure:<\/p>\n
ipmi_si IPI0001:00: IPMI message handler: Unable to get the device id: -5
\n ipmi_si IPI0001:00: Unable to register device: error -5<\/p>\n
For ipmi_si, the shutdown callback is shutdown_smi(), which cleans up
\nthe SI state machine data, frees smi_info->si_sm, and sets
\nsmi_info->si_sm and smi_info->intf to NULL.<\/p>\n
However, intf->in_shutdown is not set on this failed-registration
\nrollback path. Therefore, the asynchronous redo_bmc_reg work item can
\nstill retry BMC device-id probing after the lower driver has already
\ncleared its SI state machine data. In the observed case, that retry path
\nreached start_next_msg(), which passed the NULL smi_info->si_sm pointer
\nto the selected KCS state machine handler:<\/p>\n
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
\nWorkqueue: events redo_bmc_reg [ipmi_msghandler]
\nRIP: start_kcs_transaction+0x2c\/0x190 [ipmi_si]
\nCall Trace:
\n start_next_msg+0x50\/0x80 [ipmi_si]
\n check_start_timer_thread.part.9+0x3b\/0x50 [ipmi_si]
\n sender+0x69\/0x80 [ipmi_si]
\n i_ipmi_request+0x2ac\/0x9d0 [ipmi_msghandler]
\n __get_device_id.isra.29+0xaa\/0x180 [ipmi_msghandler]
\n __bmc_get_device_id+0xef\/0x950 [ipmi_msghandler]
\n redo_bmc_reg+0x52\/0x60 [ipmi_msghandler]
\n process_one_work+0x1a7\/0x360<\/p>\n
Set intf->in_shutdown on the out_err_started path before invoking the
\nlower driver’s shutdown callback. This prevents later redo_bmc_reg
\nretries from using an interface whose lower driver state has been
\ncleaned up, and applies the same shutdown state to other IPMI interfaces
\nas well.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipmi: si: Fix NULL pointer dereference after failed registration<\/p>\n
try_smi_init() allocates new_smi->si_sm and later calls
\nipmi_regi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21338","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}