diff options
| author | Matt Fleming <mfleming@cloudflare.com> | 2026-05-21 14:06:27 +0100 |
|---|---|---|
| committer | Corey Minyard <corey@minyard.net> | 2026-05-21 09:15:00 -0500 |
| commit | 6aa9e61c46465d231e9beddf56af7effd71be682 (patch) | |
| tree | a1681c330d2518a2c66421d5777db07fa754cf46 /drivers | |
| parent | 8a8ba84886c905bd43dbdc3b3f78c7ba8f8661f3 (diff) | |
| download | linux-next-history-6aa9e61c46465d231e9beddf56af7effd71be682.tar.gz | |
ipmi: Fix user refcount underflow in event delivery
ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the
receive message, and ipmi_free_recv_msg() drops it again. If event delivery
fails after allocating receive messages for earlier users,
handle_read_event_rsp() rolls those messages back with
ipmi_free_recv_msg().
That rollback path still drops user->refcount explicitly after freeing each
message. The extra put can free a user that remains linked on intf->users,
so later event delivery may dereference a freed user or trip refcount_t's
addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire
another reference.
Remove the stale explicit put and the now-dead user assignment. Keep the
list_del() and ipmi_free_recv_msg() calls; they are the required rollback
operations.
Fixes: b52da4054ee0 ("ipmi: Rework user message limit handling")
Cc: stable@vger.kernel.org # v6.18+
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Message-ID: <20260521130628.3641050-1-matt@readmodwrite.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/char/ipmi/ipmi_msghandler.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index 7a4566046b68c..7ca2cacbaa051 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -4472,10 +4472,8 @@ static int handle_read_event_rsp(struct ipmi_smi *intf, mutex_unlock(&intf->users_mutex); list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) { - user = recv_msg->user; list_del(&recv_msg->link); ipmi_free_recv_msg(recv_msg); - kref_put(&user->refcount, free_ipmi_user); } /* * We couldn't allocate memory for the |