ASPEED LPC snoop driver channel teardown (drivers/soc/aspeed/aspeed-lpc-snoop.c): Unbinding the LPC snoop driver tears

Impact

Unbinding the LPC snoop driver tears down channels that were never brought up, dereferencing NULL and panicking the BMC kernel. The reproducer is a single write to the driver's sysfs unbind file. Anyone with root on the BMC can hard-crash the management processor on demand; more usefully for an operator, it fires during ordinary driver reload and platform-teardown sequences, so it shows up as BMC instability on ASPEED platforms that only wire up a subset of the snoop channels.

Who can reach it

Root on the BMC (write access to the platform driver's sysfs bind/unbind), or any BMC-side maintenance flow that unbinds the driver. Not reachable from the host or the network on its own.

What to do

Kernel patch, backported to stable. Delivered only in a new BMC firmware image - per-node, out-of-band flash, gated on the ODM. Low priority as a standalone item; treat it as one more reason not to run BMC firmware images that are years behind upstream, and roll it in with the other lpc-snoop and video-engine fixes in a single flash rather than a dedicated campaign.

References