6.15-stable patches

added patches:
	ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch

diff --git a/queue-6.15/ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch b/queue-6.15/ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch
new file mode 100644 (file)
index 0000000..942f2ff
--- /dev/null
+++ b/queue-6.15/ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch
@@ -0,0 +1,49 @@
+From fa332f5dc6fc662ad7d3200048772c96b861cf6b Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Mon, 5 May 2025 17:34:15 +0300
+Subject: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit fa332f5dc6fc662ad7d3200048772c96b861cf6b upstream.
+
+The "intf" list iterator is an invalid pointer if the correct
+"intf->intf_num" is not found.  Calling atomic_dec(&intf->nr_users) on
+and invalid pointer will lead to memory corruption.
+
+We don't really need to call atomic_dec() if we haven't called
+atomic_add_return() so update the if (intf->in_shutdown) path as well.
+
+Fixes: 8e76741c3d8b ("ipmi: Add a limit on the number of users that may use IPMI")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Message-ID: <aBjMZ8RYrOt6NOgi@stanley.mountain>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+[ - Dropped change to the `if (intf->in_shutdown)` block since that logic
+    doesn't exist yet.
+  - Modified out_unlock to release the srcu lock instead of the mutex
+    since we don't have the mutex here yet. ]
+Signed-off-by: Brendan Jackman <jackmanb@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -1241,7 +1241,7 @@ int ipmi_create_user(unsigned int
+       }
+       /* Not found, return an error */
+       rv = -EINVAL;
+-      goto out_kfree;
++      goto out_unlock;
+ 
+  found:
+       if (atomic_add_return(1, &intf->nr_users) > max_users) {
+@@ -1283,6 +1283,7 @@ int ipmi_create_user(unsigned int
+ 
+ out_kfree:
+       atomic_dec(&intf->nr_users);
++out_unlock:
+       srcu_read_unlock(&ipmi_interfaces_srcu, index);
+       vfree(new_user);
+       return rv;

diff --git a/queue-6.15/series b/queue-6.15/series
index 4b657064a16cbd6a0855a3cc33ef9a11d5d41da9..10bc769459597bc0cc450996fd077340b2213ea8 100644 (file)
--- a/queue-6.15/series
+++ b/queue-6.15/series
@@ -47,3 +47,4 @@ net-sched-abort-__tc_modify_qdisc-if-parent-class-do.patch
 rxrpc-fix-bug-due-to-prealloc-collision.patch
 crypto-s390-sha-fix-uninitialized-variable-in-sha-1-and-sha-2.patch
 rxrpc-fix-oops-due-to-non-existence-of-prealloc-backlog-struct.patch
+ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch