[PATCH v2 0/3] ipmi: Close the race between __scan_channels() and deliver_response()

Jinhui Guo posted 3 patches 4 months, 1 week ago
drivers/char/ipmi/ipmi_msghandler.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
[PATCH v2 0/3] ipmi: Close the race between __scan_channels() and deliver_response()
Posted by Jinhui Guo 4 months, 1 week ago
The command "ipmi -b -t" would occasionally fail:
  #ipmitool -b 6 -t 0x2c raw 0x6 0x01
  Unable to send command: Invalid argument
  Unable to send RAW command (channel=0x6 netfn=0x6 lun=0x0 cmd=0x1)

The race window between __scan_channels() and deliver_response() causes
the parameters of some channels to be set to 0.

Fix the race between __scan_channels() and deliver_response() with the
following changes.

1. Only assign intf->channel_list = intf->wchannels and set
   intf->channels_ready = true in channel_handler() after all channels_ready
   have been successfully scanned or after failing to send the IPMI
   request.
2. channel_handler() sets intf->channels_ready to true but no one clears
   it, preventing __scan_channels() from rescanning channels. When the BMC
   firmware changes a rescan is required. Allow it by clearing the flag
   before starting a new scan.
3. Channels remain static unless the BMC firmware changes. Skip channel
   rescan when no BMC firmware update has occurred.


v1: https://lore.kernel.org/all/20250929081602.1901-1-guojinhui.liam@bytedance.com/

Changelog in v1 -> v2 (suggested by corey):
 - Split the fix into three independent patches, each addressing a
   separate issue.
 - Clear intf->channels_ready only when the BMC firmware changes.

Jinhui Guo (3):
  ipmi: Fix the race between __scan_channels() and deliver_response()
  ipmi: Fix __scan_channels() failing to rescan channels
  ipmi: Skip channel scan if channels are already marked ready

 drivers/char/ipmi/ipmi_msghandler.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

-- 
2.20.1
Re: [PATCH v2 0/3] ipmi: Close the race between __scan_channels() and deliver_response()
Posted by Corey Minyard 4 months, 1 week ago
On Tue, Sep 30, 2025 at 03:42:36PM +0800, Jinhui Guo wrote:
> The command "ipmi -b -t" would occasionally fail:
>   #ipmitool -b 6 -t 0x2c raw 0x6 0x01
>   Unable to send command: Invalid argument
>   Unable to send RAW command (channel=0x6 netfn=0x6 lun=0x0 cmd=0x1)
> 
> The race window between __scan_channels() and deliver_response() causes
> the parameters of some channels to be set to 0.
> 
> Fix the race between __scan_channels() and deliver_response() with the
> following changes.
> 
> 1. Only assign intf->channel_list = intf->wchannels and set
>    intf->channels_ready = true in channel_handler() after all channels_ready
>    have been successfully scanned or after failing to send the IPMI
>    request.
> 2. channel_handler() sets intf->channels_ready to true but no one clears
>    it, preventing __scan_channels() from rescanning channels. When the BMC
>    firmware changes a rescan is required. Allow it by clearing the flag
>    before starting a new scan.
> 3. Channels remain static unless the BMC firmware changes. Skip channel
>    rescan when no BMC firmware update has occurred.
> 
> 
> v1: https://lore.kernel.org/all/20250929081602.1901-1-guojinhui.liam@bytedance.com/
> 
> Changelog in v1 -> v2 (suggested by corey):
>  - Split the fix into three independent patches, each addressing a
>    separate issue.
>  - Clear intf->channels_ready only when the BMC firmware changes.
> 
> Jinhui Guo (3):
>   ipmi: Fix the race between __scan_channels() and deliver_response()
>   ipmi: Fix __scan_channels() failing to rescan channels
>   ipmi: Skip channel scan if channels are already marked ready

I have these queued for 6.18.  I need to re-review them; that will
probably happen later in the cycle; I can't put them in until 6.17-rc1
releases.

Thanks,

-corey

> 
>  drivers/char/ipmi/ipmi_msghandler.c | 24 +++++++++++++++++-------
>  1 file changed, 17 insertions(+), 7 deletions(-)
> 
> -- 
> 2.20.1
>
Re: [PATCH v2 0/3] ipmi: Close the race between __scan_channels() and deliver_response()
Posted by Jinhui Guo 2 months ago
On Fri, Oct 3, 2025 at 10:43:16AM -0500, Corey Minyard wrote:
> On Tue, Sep 30, 2025 at 03:42:36PM +0800, Jinhui Guo wrote:
> > The command "ipmi -b -t" would occasionally fail:
> >   #ipmitool -b 6 -t 0x2c raw 0x6 0x01
> >   Unable to send command: Invalid argument
> >   Unable to send RAW command (channel=0x6 netfn=0x6 lun=0x0 cmd=0x1)
> > 
> > The race window between __scan_channels() and deliver_response() causes
> > the parameters of some channels to be set to 0.
> > 
> > Fix the race between __scan_channels() and deliver_response() with the
> > following changes.
> > 
> > 1. Only assign intf->channel_list = intf->wchannels and set
> >    intf->channels_ready = true in channel_handler() after all channels_ready
> >    have been successfully scanned or after failing to send the IPMI
> >    request.
> > 2. channel_handler() sets intf->channels_ready to true but no one clears
> >    it, preventing __scan_channels() from rescanning channels. When the BMC
> >    firmware changes a rescan is required. Allow it by clearing the flag
> >    before starting a new scan.
> > 3. Channels remain static unless the BMC firmware changes. Skip channel
> >    rescan when no BMC firmware update has occurred.
> > 
> > 
> > v1: https://lore.kernel.org/all/20250929081602.1901-1-guojinhui.liam@bytedance.com/
> > 
> > Changelog in v1 -> v2 (suggested by corey):
> >  - Split the fix into three independent patches, each addressing a
> >    separate issue.
> >  - Clear intf->channels_ready only when the BMC firmware changes.
> > 
> > Jinhui Guo (3):
> >   ipmi: Fix the race between __scan_channels() and deliver_response()
> >   ipmi: Fix __scan_channels() failing to rescan channels
> >   ipmi: Skip channel scan if channels are already marked ready

> I have these queued for 6.18.  I need to re-review them; that will
> probably happen later in the cycle; I can't put them in until 6.17-rc1
> releases.

> Thanks,

> -corey

Hi, corey

Friendly ping — please let me know if you need anything else (rebase, more review,
test results) and I’ll be happy to take care of it.

Thanks for your time, and sorry for the noise.

Best regards,
Jinhui

> > 
> >  drivers/char/ipmi/ipmi_msghandler.c | 24 +++++++++++++++++-------
> >  1 file changed, 17 insertions(+), 7 deletions(-)
> > 
> > -- 
> > 2.20.1
> >
Re: [PATCH v2 0/3] ipmi: Close the race between __scan_channels() and deliver_response()
Posted by Corey Minyard 2 months ago
On Fri, Dec 05, 2025 at 04:01:02PM +0800, Jinhui Guo wrote:
> On Fri, Oct 3, 2025 at 10:43:16AM -0500, Corey Minyard wrote:
> > On Tue, Sep 30, 2025 at 03:42:36PM +0800, Jinhui Guo wrote:
> > > The command "ipmi -b -t" would occasionally fail:
> > >   #ipmitool -b 6 -t 0x2c raw 0x6 0x01
> > >   Unable to send command: Invalid argument
> > >   Unable to send RAW command (channel=0x6 netfn=0x6 lun=0x0 cmd=0x1)
> > > 
> > > The race window between __scan_channels() and deliver_response() causes
> > > the parameters of some channels to be set to 0.
> > > 
> > > Fix the race between __scan_channels() and deliver_response() with the
> > > following changes.
> > > 
> > > 1. Only assign intf->channel_list = intf->wchannels and set
> > >    intf->channels_ready = true in channel_handler() after all channels_ready
> > >    have been successfully scanned or after failing to send the IPMI
> > >    request.
> > > 2. channel_handler() sets intf->channels_ready to true but no one clears
> > >    it, preventing __scan_channels() from rescanning channels. When the BMC
> > >    firmware changes a rescan is required. Allow it by clearing the flag
> > >    before starting a new scan.
> > > 3. Channels remain static unless the BMC firmware changes. Skip channel
> > >    rescan when no BMC firmware update has occurred.
> > > 
> > > 
> > > v1: https://lore.kernel.org/all/20250929081602.1901-1-guojinhui.liam@bytedance.com/
> > > 
> > > Changelog in v1 -> v2 (suggested by corey):
> > >  - Split the fix into three independent patches, each addressing a
> > >    separate issue.
> > >  - Clear intf->channels_ready only when the BMC firmware changes.
> > > 
> > > Jinhui Guo (3):
> > >   ipmi: Fix the race between __scan_channels() and deliver_response()
> > >   ipmi: Fix __scan_channels() failing to rescan channels
> > >   ipmi: Skip channel scan if channels are already marked ready
> 
> > I have these queued for 6.18.  I need to re-review them; that will
> > probably happen later in the cycle; I can't put them in until 6.17-rc1
> > releases.
> 
> > Thanks,
> 
> > -corey
> 
> Hi, corey
> 
> Friendly ping — please let me know if you need anything else (rebase, more review,
> test results) and I’ll be happy to take care of it.
> 
> Thanks for your time, and sorry for the noise.

No, it was a good reminder for me, I needed to handle this.

It's been sent to Linus.

Thanks,

-corey

> 
> Best regards,
> Jinhui
> 
> > > 
> > >  drivers/char/ipmi/ipmi_msghandler.c | 24 +++++++++++++++++-------
> > >  1 file changed, 17 insertions(+), 7 deletions(-)
> > > 
> > > -- 
> > > 2.20.1
> > >