Dan Carpenter 9e0d33e75c ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() ... commit fa332f5dc6 upstream. The "intf" list iterator is an invalid pointer if the correct "intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on and invalid pointer will lead to memory corruption. We don't really need to call atomic_dec() if we haven't called atomic_add_return() so update the if (intf->in_shutdown) path as well. Fixes: 8e76741c3d ("ipmi: Add a limit on the number of users that may use IPMI") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Message-ID: <aBjMZ8RYrOt6NOgi@stanley.mountain> Signed-off-by: Corey Minyard <corey@minyard.net> [ - Dropped change to the `if (intf->in_shutdown)` block since that logic doesn't exist yet. - Modified out_unlock to release the srcu lock instead of the mutex since we don't have the mutex here yet. ] Signed-off-by: Brendan Jackman <jackmanb@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-07-17 18:37:07 +02:00
..
agp
hw_random
ipmi	ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()	2025-07-17 18:37:07 +02:00
mwave
tpm	char: tpm: tpm-buf: Add sanity check fallback in read helpers	2025-06-04 14:43:53 +02:00
xilinx_hwicap
xillybus
adi.c
apm-emulation.c
applicom.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
applicom.h
bsr.c
ds1620.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
dsp56k.c
dtlk.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
hangcheck-timer.c
hpet.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
Kconfig
lp.c
Makefile
mem.c
misc.c	char: misc: register chrdev region with all possible minors	2025-05-02 07:59:10 +02:00
nsc_gpio.c
nvram.c
nwbutton.c
nwbutton.h
nwflash.c
pc8736x_gpio.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
powernv-op-panel.c
ppdev.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
ps3flash.c
random.c
scx200_gpio.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
sonypi.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
tlclk.c
toshiba.c
ttyprintk.c
uv_mmtimer.c
virtio_console.c	virtio_console: fix missing byte order handling for cols and rows	2025-05-02 07:59:05 +02:00