Dan Carpenter 9e0d33e75c ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() ... commit fa332f5dc6 upstream. The "intf" list iterator is an invalid pointer if the correct "intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on and invalid pointer will lead to memory corruption. We don't really need to call atomic_dec() if we haven't called atomic_add_return() so update the if (intf->in_shutdown) path as well. Fixes: 8e76741c3d ("ipmi: Add a limit on the number of users that may use IPMI") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Message-ID: <aBjMZ8RYrOt6NOgi@stanley.mountain> Signed-off-by: Corey Minyard <corey@minyard.net> [ - Dropped change to the `if (intf->in_shutdown)` block since that logic doesn't exist yet. - Modified out_unlock to release the srcu lock instead of the mutex since we don't have the mutex here yet. ] Signed-off-by: Brendan Jackman <jackmanb@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-07-17 18:37:07 +02:00
..
agp	Char/Misc and other driver changes for 6.11-rc1	2024-07-19 15:55:08 -07:00
hw_random	hwrng: mtk - Use devm_pm_runtime_enable	2024-09-06 14:50:45 +08:00
ipmi	ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()	2025-07-17 18:37:07 +02:00
mwave
tpm	char: tpm: tpm-buf: Add sanity check fallback in read helpers	2025-06-04 14:43:53 +02:00
xilinx_hwicap
xillybus	char: xillybus: Check USB endpoints when probing device	2024-08-16 09:57:56 +02:00
adi.c	vfs-6.12.file	2024-09-16 09:14:02 +02:00
apm-emulation.c
applicom.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
applicom.h
bsr.c
ds1620.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
dsp56k.c
dtlk.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
hangcheck-timer.c
hpet.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
Kconfig
lp.c
Makefile
mem.c	fs: move FMODE_UNSIGNED_OFFSET to fop_flags	2024-08-30 08:22:36 +02:00
misc.c	char: misc: register chrdev region with all possible minors	2025-05-02 07:59:10 +02:00
nsc_gpio.c
nvram.c
nwbutton.c	char: add missing NetWinder MODULE_DESCRIPTION() macros	2024-07-31 13:47:45 +02:00
nwbutton.h
nwflash.c	char: add missing NetWinder MODULE_DESCRIPTION() macros	2024-07-31 13:47:45 +02:00
pc8736x_gpio.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
powernv-op-panel.c
ppdev.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
ps3flash.c
random.c	random: vDSO: add __arch_get_k_vdso_rng_data() helper for data page access	2024-09-13 17:28:35 +02:00
scx200_gpio.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
sonypi.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
tlclk.c
toshiba.c
ttyprintk.c
uv_mmtimer.c
virtio_console.c	virtio_console: fix missing byte order handling for cols and rows	2025-05-02 07:59:05 +02:00