[PATCH v1] ACPI: IPMI: Fix message kref handling on dead device

[PATCH v1] ACPI: IPMI: Fix message kref handling on dead device

[Yuho Choi]

acpi_ipmi_space_handler() takes an extra reference on tx_msg before
checking whether the selected IPMI device is dead. The reference
belongs to the tx_msg_list entry and is normally dropped by
ipmi_cancel_tx_msg() or ipmi_flush_tx_msg() after the message is removed
from the list.

On the dead-device path, the message has not been queued yet, but the
error path still calls ipmi_msg_release() directly. That bypasses
kref_put() and frees tx_msg while the queued-message reference is still
recorded in the kref count.

Take the queued-message reference only after the dead-device check
succeeds, immediately before adding tx_msg to the list.

Fixes: 7b9844772237 ("ACPI / IPMI: Add reference counting for ACPI IPMI transfers")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 drivers/acpi/acpi_ipmi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
index 8f1aeae8b72e..79ce6e72bf29 100644
--- a/drivers/acpi/acpi_ipmi.c
+++ b/drivers/acpi/acpi_ipmi.c
@@ -550,7 +550,6 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
 		return AE_TYPE;
 	}
 
-	acpi_ipmi_msg_get(tx_msg);
 	mutex_lock(&driver_data.ipmi_lock);
 	/* Do not add a tx_msg that can not be flushed. */
 	if (ipmi_device->dead) {
@@ -558,6 +557,7 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
 		ipmi_msg_release(tx_msg);
 		return AE_NOT_EXIST;
 	}
+	acpi_ipmi_msg_get(tx_msg);
 	spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
 	list_add_tail(&tx_msg->head, &ipmi_device->tx_msg_list);
 	spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
-- 
2.43.0

Re: [PATCH v1] ACPI: IPMI: Fix message kref handling on dead device

[Rafael J. Wysocki]

On Wed, Jun 3, 2026 at 6:31 PM Yuho Choi <dbgh9129@gmail.com> wrote:
>
> acpi_ipmi_space_handler() takes an extra reference on tx_msg before
> checking whether the selected IPMI device is dead. The reference
> belongs to the tx_msg_list entry and is normally dropped by
> ipmi_cancel_tx_msg() or ipmi_flush_tx_msg() after the message is removed
> from the list.
>
> On the dead-device path, the message has not been queued yet, but the
> error path still calls ipmi_msg_release() directly. That bypasses
> kref_put() and frees tx_msg while the queued-message reference is still
> recorded in the kref count.
>
> Take the queued-message reference only after the dead-device check
> succeeds, immediately before adding tx_msg to the list.
>
> Fixes: 7b9844772237 ("ACPI / IPMI: Add reference counting for ACPI IPMI transfers")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> ---
>  drivers/acpi/acpi_ipmi.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
> index 8f1aeae8b72e..79ce6e72bf29 100644
> --- a/drivers/acpi/acpi_ipmi.c
> +++ b/drivers/acpi/acpi_ipmi.c
> @@ -550,7 +550,6 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
>                 return AE_TYPE;
>         }
>
> -       acpi_ipmi_msg_get(tx_msg);
>         mutex_lock(&driver_data.ipmi_lock);
>         /* Do not add a tx_msg that can not be flushed. */
>         if (ipmi_device->dead) {
> @@ -558,6 +557,7 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
>                 ipmi_msg_release(tx_msg);
>                 return AE_NOT_EXIST;
>         }
> +       acpi_ipmi_msg_get(tx_msg);
>         spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
>         list_add_tail(&tx_msg->head, &ipmi_device->tx_msg_list);
>         spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
> --

Applied as 7.2 material, thanks!