diff options
| author | Yifei Gao <gyf161023@gmail.com> | 2026-08-25 23:46:29 +0000 |
|---|---|---|
| committer | Corey Minyard <corey@minyard.net> | 2026-08-25 18:55:02 -0500 |
| commit | 05ec76cfbce653e07cec19b9b8b20e33449d5d87 (patch) | |
| tree | 5485ccf1974ac6efc8b492288bf08fae99cb0433 /drivers | |
| parent | ae84a2536577057e97f23f75a202e26d0e86cf01 (diff) | |
| download | linux-05ec76cfbce653e07cec19b9b8b20e33449d5d87.tar.gz linux-05ec76cfbce653e07cec19b9b8b20e33449d5d87.zip | |
ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the
ipmi_interfaces list") dropped the synchronize_rcu() between unlinking
the command receivers from intf->cmd_rcvrs and freeing them, updating
only the comment that explains why the barrier is needed.
The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr()
walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows
rcvr->user from that lookup within the same read-side section. Without
the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a
reader still holds a pointer to it, causing a use-after-free.
The rework only made srcu unnecessary for the interfaces list; the
cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu()
before freeing the receivers.
Fixes: 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Yifei Gao <gyf161023@gmail.com>
Message-ID: <20260825234630.1196170-1-gyf161023@gmail.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/char/ipmi/ipmi_msghandler.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index c73e9def59a6..152dd6b5bb27 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -1391,6 +1391,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user) } } mutex_unlock(&intf->cmd_rcvrs_mutex); + synchronize_rcu(); while (rcvrs) { rcvr = rcvrs; rcvrs = rcvr->next; |