]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ipmi: fix use after free in _ipmi_destroy_user()
authorDan Carpenter <error27@gmail.com>
Tue, 15 Nov 2022 13:17:43 +0000 (16:17 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 7 Jan 2023 10:15:56 +0000 (11:15 +0100)
commitf7fde441198a9ecb130c3ccec91ee2131d6998ee
tree6a173f3beaf5bfc0ec9fd9d98b9e4cfbfe66c193
parent2ec49bc5257e118dd70e2e12c1cd30ed6d6671cc
ipmi: fix use after free in _ipmi_destroy_user()

commit a92ce570c81dc0feaeb12a429b4bc65686d17967 upstream.

The intf_free() function frees the "intf" pointer so we cannot
dereference it again on the next line.

Fixes: cbb79863fc31 ("ipmi: Don't allow device module unload when in use")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Message-Id: <Y3M8xa1drZv4CToE@kili>
Cc: <stable@vger.kernel.org> # 5.5+
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/char/ipmi/ipmi_msghandler.c