Merge tag 'for-linus-4.16-1' of git://github.com/cminyard/linux-ipmi

Pull IPMI updates from Corey Minyard:
 "Small fixes for various things, been sitting in next for a while (some
  a long time)"

* tag 'for-linus-4.16-1' of git://github.com/cminyard/linux-ipmi:
  ipmi_ssif: Remove duplicate NULL check
  ipmi/powernv: Fix error return code in ipmi_powernv_probe()
  ipmi: use dynamic memory for DMI driver override
  ipmi/ipmi_powernv: remove outdated todo in powernv IPMI driver
  ipmi: Clear smi_info->thread to prevent use-after-free during module unload
  ipmi: use correct string length
  ipmi_si: Fix error handling of platform device
  ipmi watchdog: fix typo in parameter description
  ipmi_si_platform: Fix typo in parameter description

drivers/char/ipmi/ipmi_dmi.c

@@ -106,7 +106,10 @@ static void __init dmi_add_platform_ipmi(unsigned long base_addr,
 		pr_err("ipmi:dmi: Error allocation IPMI platform device\n");
 		return;
 	}
-	pdev->driver_override = override;
+	pdev->driver_override = kasprintf(GFP_KERNEL, "%s",
+					  override);
+	if (!pdev->driver_override)
+		goto err;
 
 	if (type == IPMI_DMI_TYPE_SSIF) {
 		set_prop_entry(p[pidx++], "i2c-addr", u16, base_addr);

drivers/char/ipmi/ipmi_msghandler.c

@@ -84,7 +84,7 @@ static int panic_op_write_handler(const char *val,
 	char valcp[16];
 	char *s;
 
-	strncpy(valcp, val, 16);
+	strncpy(valcp, val, 15);
 	valcp[15] = '\0';
 
 	s = strstrip(valcp);

drivers/char/ipmi/ipmi_powernv.c

@@ -250,8 +250,9 @@ static int ipmi_powernv_probe(struct platform_device *pdev)
 		ipmi->irq = opal_event_request(prop);
 	}
 
-	if (request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH,
-				"opal-ipmi", ipmi)) {
+	rc = request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH,
+			 "opal-ipmi", ipmi);
+	if (rc) {
 		dev_warn(dev, "Unable to request irq\n");
 		goto err_dispose;
 	}
@@ -264,7 +265,6 @@ static int ipmi_powernv_probe(struct platform_device *pdev)
 		goto err_unregister;
 	}
 
-	/* todo: query actual ipmi_device_id */
 	rc = ipmi_register_smi(&ipmi_powernv_smi_handlers, ipmi, dev, 0);
 	if (rc) {
 		dev_warn(dev, "IPMI SMI registration failed (%d)\n", rc);

drivers/char/ipmi/ipmi_si_intf.c

@@ -1938,8 +1938,10 @@ static void check_for_broken_irqs(struct smi_info *smi_info)
 
 static inline void stop_timer_and_thread(struct smi_info *smi_info)
 {
-	if (smi_info->thread != NULL)
+	if (smi_info->thread != NULL) {
 		kthread_stop(smi_info->thread);
+		smi_info->thread = NULL;
+	}
 
 	smi_info->timer_can_start = false;
 	if (smi_info->timer_running)
@@ -2045,6 +2047,7 @@ static int try_smi_init(struct smi_info *new_smi)
 	int rv = 0;
 	int i;
 	char *init_name = NULL;
+	bool platform_device_registered = false;
 
 	pr_info(PFX "Trying %s-specified %s state machine at %s address 0x%lx, slave address 0x%x, irq %d\n",
 		ipmi_addr_src_to_str(new_smi->io.addr_source),
@@ -2173,6 +2176,7 @@ static int try_smi_init(struct smi_info *new_smi)
 				rv);
 			goto out_err;
 		}
+		platform_device_registered = true;
 	}
 
 	dev_set_drvdata(new_smi->io.dev, new_smi);
@@ -2279,10 +2283,11 @@ static int try_smi_init(struct smi_info *new_smi)
 	}
 
 	if (new_smi->pdev) {
+		if (platform_device_registered)
 			platform_device_unregister(new_smi->pdev);
-		new_smi->pdev = NULL;
-	} else if (new_smi->pdev) {
+		else
 			platform_device_put(new_smi->pdev);
+		new_smi->pdev = NULL;
 	}
 
 	kfree(init_name);

drivers/char/ipmi/ipmi_si_platform.c

@@ -40,7 +40,7 @@ MODULE_PARM_DESC(tryacpi, "Setting this to zero will disable the"
 #endif
 #ifdef CONFIG_OF
 module_param_named(tryopenfirmware, si_tryopenfirmware, bool, 0);
-MODULE_PARM_DESC(tryacpi, "Setting this to zero will disable the"
+MODULE_PARM_DESC(tryopenfirmware, "Setting this to zero will disable the"
 		 " default scan of the interfaces identified via OpenFirmware");
 #endif
 #ifdef CONFIG_DMI

drivers/char/ipmi/ipmi_ssif.c

@@ -2071,7 +2071,6 @@ static int ssif_platform_remove(struct platform_device *dev)
 		return 0;
 
 	mutex_lock(&ssif_infos_mutex);
-	if (addr_info->client)
 	i2c_unregister_device(addr_info->client);
 
 	list_del(&addr_info->link);

drivers/char/ipmi/ipmi_watchdog.c

@@ -232,7 +232,7 @@ static int set_param_str(const char *val, const struct kernel_param *kp)
 	char       valcp[16];
 	char       *s;
 
-	strncpy(valcp, val, 16);
+	strncpy(valcp, val, 15);
 	valcp[15] = '\0';
 
 	s = strstrip(valcp);
@@ -298,7 +298,7 @@ module_param(pretimeout, timeout, 0644);
 MODULE_PARM_DESC(pretimeout, "Pretimeout value in seconds.");
 
 module_param(panic_wdt_timeout, timeout, 0644);
-MODULE_PARM_DESC(timeout, "Timeout value on kernel panic in seconds.");
+MODULE_PARM_DESC(panic_wdt_timeout, "Timeout value on kernel panic in seconds.");
 
 module_param_cb(action, &param_ops_str, action_op, 0644);
 MODULE_PARM_DESC(action, "Timeout action. One of: "