From: Greg Kroah-Hartman Date: Sat, 12 Jul 2025 13:53:34 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v5.15.188~66 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6bd384ca2039f584437f5a4f9b130687035915fa;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch --- diff --git a/queue-6.12/ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch b/queue-6.12/ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch new file mode 100644 index 0000000000..942f2fff0d --- /dev/null +++ b/queue-6.12/ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch @@ -0,0 +1,49 @@ +From fa332f5dc6fc662ad7d3200048772c96b861cf6b Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 5 May 2025 17:34:15 +0300 +Subject: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() + +From: Dan Carpenter + +commit fa332f5dc6fc662ad7d3200048772c96b861cf6b upstream. + +The "intf" list iterator is an invalid pointer if the correct +"intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on +and invalid pointer will lead to memory corruption. + +We don't really need to call atomic_dec() if we haven't called +atomic_add_return() so update the if (intf->in_shutdown) path as well. + +Fixes: 8e76741c3d8b ("ipmi: Add a limit on the number of users that may use IPMI") +Signed-off-by: Dan Carpenter +Message-ID: +Signed-off-by: Corey Minyard +[ - Dropped change to the `if (intf->in_shutdown)` block since that logic + doesn't exist yet. + - Modified out_unlock to release the srcu lock instead of the mutex + since we don't have the mutex here yet. ] +Signed-off-by: Brendan Jackman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_msghandler.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -1241,7 +1241,7 @@ int ipmi_create_user(unsigned int + } + /* Not found, return an error */ + rv = -EINVAL; +- goto out_kfree; ++ goto out_unlock; + + found: + if (atomic_add_return(1, &intf->nr_users) > max_users) { +@@ -1283,6 +1283,7 @@ int ipmi_create_user(unsigned int + + out_kfree: + atomic_dec(&intf->nr_users); ++out_unlock: + srcu_read_unlock(&ipmi_interfaces_srcu, index); + vfree(new_user); + return rv; diff --git a/queue-6.12/series b/queue-6.12/series index e53bfd5041..948d0df281 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -46,3 +46,4 @@ net-ethernet-ti-am65-cpsw-nuss-fix-skb-size-by-accou.patch net-sched-abort-__tc_modify_qdisc-if-parent-class-do.patch rxrpc-fix-bug-due-to-prealloc-collision.patch rxrpc-fix-oops-due-to-non-existence-of-prealloc-backlog-struct.patch +ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch