diff options
| author | Wentao Liang <vulab@iscas.ac.cn> | 2026-06-03 12:06:34 +0000 |
|---|---|---|
| committer | Corey Minyard <corey@minyard.net> | 2026-06-03 07:20:31 -0500 |
| commit | a3f3859cecacb64f18fd446271ece9a3b3f2d4de (patch) | |
| tree | 01f931a7786bf98dee9c52cfea5d50e8ad9175a2 | |
| parent | 1aec36f2f362e4e6d25413113fc363c2c57a9aa0 (diff) | |
| download | linux-a3f3859cecacb64f18fd446271ece9a3b3f2d4de.tar.gz linux-a3f3859cecacb64f18fd446271ece9a3b3f2d4de.zip | |
ipmi: fix refcount leak in i_ipmi_request()
When a caller provides a `supplied_recv` message to i_ipmi_request(),
the function increments the user's `nr_msgs` reference count. If an
error occurs later, the out_err cleanup path only frees the recv_msg
if the function allocated it itself (i.e., !supplied_recv). In the
supplied_recv case the cleanup is skipped, leaving the reference count
elevated. The caller ipmi_request_supply_msgs() does not release the
supplied_recv on error, so the reference is permanently leaked.
Fix this by explicitly reverting the reference count operations when a
supplied recv_msg with a valid user pointer is present in the error
path: decrement nr_msgs and drop the user's kref.
Cc: stable@vger.kernel.org
Fixes: b52da4054ee0 ("ipmi: Rework user message limit handling")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Message-ID: <20260603120634.3758747-1-vulab@iscas.ac.cn>
Signed-off-by: Corey Minyard <corey@minyard.net>
| -rw-r--r-- | drivers/char/ipmi/ipmi_msghandler.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index 7ca2cacbaa05..ab4c85f3d6fe 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -2345,6 +2345,10 @@ static int i_ipmi_request(struct ipmi_user *user, if (smi_msg == NULL) { if (!supplied_recv) ipmi_free_recv_msg(recv_msg); + else if (recv_msg->user) { + atomic_dec(&recv_msg->user->nr_msgs); + kref_put(&recv_msg->user->refcount, free_ipmi_user); + } return -ENOMEM; } } @@ -2418,6 +2422,10 @@ out_err: ipmi_free_smi_msg(smi_msg); if (!supplied_recv) ipmi_free_recv_msg(recv_msg); + else if (recv_msg->user) { + atomic_dec(&recv_msg->user->nr_msgs); + kref_put(&recv_msg->user->refcount, free_ipmi_user); + } } return rv; } |