Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1449925
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 062/146] ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg() |
| Date | 2016-07-25 23:30 +0200 |
| Message-ID | <rYVBM-1gH-37@gated-at.bofh.it> (permalink) |
| References | <rYV8K-Pn-13@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junichi Nomura <j-nomura@ce.jp.nec.com>
commit ae4ea9a2460c7fee2ae8feeb4dfe96f5f6c3e562 upstream.
Commit 7ea0ed2b5be8 ("ipmi: Make the message handler easier to use for
SMI interfaces") changed handle_new_recv_msgs() to call handle_one_recv_msg()
for a smi_msg while the smi_msg is still connected to waiting_rcv_msgs list.
That could lead to following list corruption problems:
1) low-level function treats smi_msg as not connected to list
handle_one_recv_msg() could end up calling smi_send(), which
assumes the msg is not connected to list.
For example, the following sequence could corrupt list by
doing list_add_tail() for the entry still connected to other list.
handle_new_recv_msgs()
msg = list_entry(waiting_rcv_msgs)
handle_one_recv_msg(msg)
handle_ipmb_get_msg_cmd(msg)
smi_send(msg)
spin_lock(xmit_msgs_lock)
list_add_tail(msg)
spin_unlock(xmit_msgs_lock)
2) race between multiple handle_new_recv_msgs() instances
handle_new_recv_msgs() once releases waiting_rcv_msgs_lock before calling
handle_one_recv_msg() then retakes the lock and list_del() it.
If others call handle_new_recv_msgs() during the window shown below
list_del() will be done twice for the same smi_msg.
handle_new_recv_msgs()
spin_lock(waiting_rcv_msgs_lock)
msg = list_entry(waiting_rcv_msgs)
spin_unlock(waiting_rcv_msgs_lock)
|
| handle_one_recv_msg(msg)
|
spin_lock(waiting_rcv_msgs_lock)
list_del(msg)
spin_unlock(waiting_rcv_msgs_lock)
Fixes: 7ea0ed2b5be8 ("ipmi: Make the message handler easier to use for SMI interfaces")
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
[Added a comment to describe why this works.]
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Tested-by: Ye Feng <yefeng.yl@alibaba-inc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_msghandler.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3819,6 +3819,7 @@ static void handle_new_recv_msgs(ipmi_sm
while (!list_empty(&intf->waiting_rcv_msgs)) {
smi_msg = list_entry(intf->waiting_rcv_msgs.next,
struct ipmi_smi_msg, link);
+ list_del(&smi_msg->link);
if (!run_to_completion)
spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
flags);
@@ -3828,11 +3829,14 @@ static void handle_new_recv_msgs(ipmi_sm
if (rv > 0) {
/*
* To preserve message order, quit if we
- * can't handle a message.
+ * can't handle a message. Add the message
+ * back at the head, this is safe because this
+ * tasklet is the only thing that pulls the
+ * messages.
*/
+ list_add(&smi_msg->link, &intf->waiting_rcv_msgs);
break;
} else {
- list_del(&smi_msg->link);
if (rv == 0)
/* Message handled */
ipmi_free_smi_msg(smi_msg);
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 000/146] 4.4.16-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:10 +0200
[PATCH 4.4 060/146] iommu/amd: Fix unity mapping initialization race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 134/146] ovl: verify upper dentry in ovl_remove_and_whiteout() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 139/146] cifs: dynamic allocation of ntlmssp blob Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 145/146] drm/i915: Revert DisplayPort fast link training feature Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 097/146] iio: Fix error handling in iio_trigger_attach_poll_func Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 054/146] HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 116/146] ALSA: dummy: Fix a use-after-free at closing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 096/146] xen/balloon: Fix declared-but-not-defined warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 146/146] ovl: verify upper dentry before unlink and rename Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 143/146] tmpfs: dont undo fallocate past its last page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 144/146] tmpfs: fix regression hang in fallocate undo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 072/146] drm/amdkfd: unbind only existing processes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
[PATCH 4.4 105/146] iio: hudmidity: hdc100x: fix incorrect shifting and scaling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 119/146] ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 141/146] xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 102/146] iio: proximity: as3935: fix buffer stack trashing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 110/146] iio:ad7266: Fix probe deferral for vref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 132/146] ARM: mvebu: fix HW I/O coherency related deadlocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 099/146] iio: light apds9960: Add the missing dev.parent Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 137/146] 53c700: fix BUG on untagged commands Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 138/146] Fix reconnect to not defer smb3 session reconnect long after socket reconnect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 142/146] crypto: qat - make qat_asym_algs.o depend on asn1 headers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 129/146] ALSA: hda: add AMD Stoney PCI ID with proper driver caps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 123/146] ALSA: hda - Add PCI ID for Kabylake-H Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 117/146] ALSA: hda - Fix the headset mic jack detection on Dell machine Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 135/146] scsi: fix race between simultaneous decrements of ->host_failed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 100/146] iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 121/146] ALSA: timer: Fix negative queue usage by racy accesses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 062/146] ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 120/146] ALSA: echoaudio: Fix memory allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 064/146] vfs: add d_real_inode() helper Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 106/146] staging: iio: accel: fix error check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 133/146] ovl: Copy up underlying inodes ->i_mode to overlay inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
Re: [PATCH 4.4 133/146] ovl: Copy up underlying inodes ->i_mode to overlay inode Eryu Guan <eguan@redhat.com> - 2016-08-03 09:40 +0200
Re: [PATCH 4.4 133/146] ovl: Copy up underlying inodes ->i_mode to overlay inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-03 10:00 +0200
Re: [PATCH 4.4 133/146] ovl: Copy up underlying inodes ->i_mode to overlay inode Eryu Guan <eguan@redhat.com> - 2016-08-03 10:20 +0200
Re: [PATCH 4.4 133/146] ovl: Copy up underlying inodes ->i_mode to overlay inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-03 13:20 +0200
[PATCH 4.4 090/146] drm/vmwgfx: Work around mode set failure in 2D VMs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 130/146] ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 126/146] ALSA: pcm: Free chmap at PCM free callback, too Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 103/146] iio: humidity: hdc100x: correct humidity integration time mask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 122/146] ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 124/146] ALSA: hda - fix read before array start Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 128/146] ALSA: hda - fix use-after-free after module unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 104/146] iio: humidity: hdc100x: fix IIO_TEMP channel reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 140/146] File names with trailing period or space need special case conversion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 111/146] tty: vt: Fix soft lockup in fbcon cursor blink timer. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 118/146] ALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 127/146] ALSA: ctl: Stop notification after disconnection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 131/146] ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 101/146] iio: proximity: as3935: remove triggered buffer processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 125/146] ALSA: hda/realtek - add new pin definition in alc225 pin quirk table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 136/146] s390: fix test_fp_ctl inline assembly contraints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
[PATCH 4.4 112/146] tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:40 +0200
[PATCH 4.4 063/146] arm64: Rework valid_user_regs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:40 +0200
[PATCH 4.4 109/146] iio:ad7266: Fix support for optional regulators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:40 +0200
[PATCH 4.4 108/146] iio:ad7266: Fix broken regulator error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:30 +0200
[PATCH 4.4 079/146] drm/nouveau: fix for disabled fbdev emulation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 078/146] drm/nouveau/fbcon: fix out-of-bounds memory accesses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 022/146] locking/static_key: Fix concurrent static_key_slow_inc() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 083/146] drm/i915: Update ifdeffery for mutex->owner Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 059/146] iommu/vt-d: Enable QI on all IOMMUs before setting root entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 093/146] drm/vmwgfx: Fix error paths when mapping framebuffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 107/146] iio: accel: kxsd9: fix the usage of spi_w8r8() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 098/146] iio:st_pressure: fix sampling gains (bring inline with ABI) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 089/146] drm/vmwgfx: Add an option to change assumed FB bpp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 058/146] iommu/arm-smmu: Wire up map_sg for arm-smmu-v3 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 088/146] drm/ttm: Make ttm_bo_mem_compat available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 086/146] drm: make drm_atomic_set_mode_prop_for_crtc() more reliable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 061/146] drm/mgag200: Black screen fix for G200e rev 4 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 087/146] drm: atmel-hlcdc: actually disable scaling when no scaling is required Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 092/146] drm/vmwgfx: Delay pinning fbdev framebuffer until after mode set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 091/146] drm/vmwgfx: Check pin count before attempting to move a buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 085/146] drm: add missing drm_mode_set_crtcinfo call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 095/146] perf/x86: Fix undefined shift on 32-bit kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 077/146] drm/nouveau/gr/gf100-: update sm error decoding from gk20a nvgpu headers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 055/146] HID: multitouch: enable palm rejection for Windows Precision Touchpad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 080/146] drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
[PATCH 4.4 066/146] percpu: fix synchronization between chunk->map_extend_work and chunk destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 068/146] btrfs: account for non-CoWd blocks in btrfs_abort_transaction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 023/146] x86, build: copy ldlinux.c32 to image.iso Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 065/146] af_unix: fix hard linked sockets on overlay Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 019/146] of: irq: fix of_irq_get[_byname]() kernel-doc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 073/146] drm/amdkfd: destroy dbgmgr in notifier release Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 075/146] virtio_balloon: fix PFN format for virtio-1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 018/146] of: fix autoloading due to broken modalias with no compatible Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 074/146] drm/dp/mst: Always clear proposed vcpi table for port. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 056/146] tracing: Handle NULL formats in hold_module_trace_bprintk_format() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 014/146] usb: common: otg-fsm: add license to usb-otg-fsm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 020/146] locking/ww_mutex: Report recursive ww_mutex locking early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 070/146] drm/amdgpu/gfx7: fix broken condition check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 021/146] locking/qspinlock: Fix spin_unlock_wait() some more Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 057/146] base: make module_create_drivers_dir race-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 076/146] drm/nouveau/disp/sor/gf119: both links use the same training register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 067/146] percpu: fix synchronization between synchronous map extension and chunk destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
[PATCH 4.4 069/146] drm/radeon: fix asic initialization for virtualized environments Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
Re: [PATCH 4.4 000/146] 4.4.16-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-07-26 04:10 +0200
Re: [PATCH 4.4 000/146] 4.4.16-stable review Guenter Roeck <linux@roeck-us.net> - 2016-07-26 16:00 +0200
Re: [PATCH 4.4 000/146] 4.4.16-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-27 06:50 +0200
csiph-web