From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oa1-f52.google.com (mail-oa1-f52.google.com [209.85.160.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C59335C182 for ; Tue, 27 Jan 2026 14:46:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769525213; cv=none; b=dISrbISyDyTKmOmjY2+sDXX4nP1RacyuYeKfFbXV+67RUgOQbAFxKyBP78yL1fxNHCFpo006EPBK0CSVnQI3CSOjXxd2FwhtxdY7r/ApildKWs4PmL6zl2URVwLZ0J0PmozyUGGmugBDSE7qxbtYt1Mc2lexm7Nn/cIXqLUeqLc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769525213; c=relaxed/simple; bh=9RKO4nU8rGrY2rJzToXBwy7qqyRg6VuRq1QFDWuUt8s=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=A5zak0uLhe1l0px6sn5vxDqStQRJLvfEpi4PS2y0uZxGQvPQ5cFl0xOoC6haTLN1vOQwlTuWO5Lak4PRXJF9qLpo+yCFqf5zAgWfYT2dciEEvjeSMMpvqrBZ4Es8HljSvSk1xilXJlJ1JgPByabGUuE9pwGmfeBVu2N1In5cezQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=minyard.net; spf=pass smtp.mailfrom=minyard.net; dkim=pass (2048-bit key) header.d=minyard.net header.i=@minyard.net header.b=N9DID8sZ; arc=none smtp.client-ip=209.85.160.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=minyard.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=minyard.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=minyard.net header.i=@minyard.net header.b="N9DID8sZ" Received: by mail-oa1-f52.google.com with SMTP id 586e51a60fabf-4042905015cso3484752fac.0 for ; Tue, 27 Jan 2026 06:46:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=minyard.net; s=google; t=1769525210; x=1770130010; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=6Tb2f1vtujh1yFSAc7vww/wAqd7C0+upyJOHXMhwugE=; b=N9DID8sZ75xOgrx5c6IL7OUBZhEILzl+Xmq+xhT21TotS/qBheCC/q9XYtVP2D5Cb2 fn5Kk0UoAa+9+unHup2XH9A3gcCnD9KWvkGvyre57setGr/HbRgiFgIWECP1BFktGMKC 1OypFVSv7pGnuomlAE2QWXQYWgbad5M7Dn7QlPnRH05cqSL5IB/wSeE1Hu3pKNiVTB6t hxKW91lFr9XPa89Z30DJUrdBsPiuGGAFqYfr8cvh1/Mo4wCAmXBm+Tcld9S38PcXTgze 4gjQOTJa010ePBywBiLaqMOwGScQn8H/K0hNjaO8TxHXp7MuA2l/jk2EV7ZoO/Cu1eLn sgbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769525210; x=1770130010; h=in-reply-to:content-disposition:mime-version:references:reply-to :message-id:subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=6Tb2f1vtujh1yFSAc7vww/wAqd7C0+upyJOHXMhwugE=; b=MsyXeUYNUoPhwCyjziJ+p/LMlkZqqadI1xRI4PzgHrib7Ep+0kFtONcZSwzNV2ptKh qkYb04K8MQ/HHXrffQuOxJ5GN+Ro6FbYqhizm3eblAw337arTjrFfvsFOb0KSK1Sp/mI g+QPW9UYJS97Hbw2wIbbQ2L4hIysTN+dhOAc3JqffU3QvqQd6qrggH/mO59U8jxnJopm MoVyxT0yQnHgh6gayYcjk6/PL3rwUvg/F2eqlhFFTeFBb/jv0zM7qF/D1v0pwjd2fGm9 kO3zMMaCWEv1xiwL3PBNab+Cd0NHA+y3/rOwHHwxh854H4dguBdrSoDW2WXqND51O7rE xKfw== X-Forwarded-Encrypted: i=1; AJvYcCU1L8lvMFQfJL+3rP4GMBomef2RdvB7Sw/mrxtsG6XhL2xciLFBWZKhIKEFjTTSUXSm2SWId51OYTcZRRY=@vger.kernel.org X-Gm-Message-State: AOJu0Yzoj2CJ6VDfHN4pi/XwqPVQWfopiYCtePzrCiaHXnE+4T603fS0 WTkZTSAhGRGCTd3/vmaShQ0NxXBK1ELTW5sToqOdYwGbUfizlwIkab4z+E1uMKJ9x2I= X-Gm-Gg: AZuq6aJSlqipcSoiwhY34DJ2hjnpqe27rccJfBsPxhcDMnaWCWmf64UktCjpmPk3i3/ JjM7p3QIOj2iZvINoIqez7LP1hH39oiSuhCts75OqUC1ilFUUdXviyhS0fpnaVJu64eqopJIA2J xtbYPVKt1D0NCssevlTePWmTuRo/VrGfXBHCM63mrJc5nN+kjzc53zyHT8wV3fd/wl1IK125chM /mSpqSTNVr3wMxk45veQNgw199ArAaT/9RzK0FwoRL1miggAL9pBvvyFuIOM6eWqS6bJ+q2I63W YTOw39JFOGCuYK2A3JFVXNb/YyvmpDOo3J19x8nNG5V3ythFljrKda2Xk/z6LLy2Tn1LELY+Kq1 qaQvK+L6+kpdrwzLuyrMS/H+ZQla6SrKmEC72kaV/Xs2PhZuMr7aTKQgHPultLf8MXXJTVHBf/n 4Sb9iSfiNzqbE8vj2z4sSM/AhvDqRfZ7TsC7c6seMbZhqx9MBY9q4UacbOYFPWRZx52maV2vODv ok= X-Received: by 2002:a05:6820:1caa:b0:659:9a49:8fb8 with SMTP id 006d021491bc7-662f20d4644mr1237703eaf.49.1769525209964; Tue, 27 Jan 2026 06:46:49 -0800 (PST) Received: from mail.minyard.net ([2001:470:b8f6:1b:a1a5:d807:e7a1:53eb]) by smtp.gmail.com with ESMTPSA id 006d021491bc7-662cb4f29e1sm6739005eaf.7.2026.01.27.06.46.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 27 Jan 2026 06:46:49 -0800 (PST) Date: Tue, 27 Jan 2026 08:46:44 -0600 From: Corey Minyard To: Breno Leitao Cc: Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt , openipmi-developer@lists.sourceforge.net, linux-kernel@vger.kernel.org, llvm@lists.linux.dev, kernel-team@meta.com Subject: Re: [PATCH 1/2] ipmi: Fix use-after-free and list corruption on sender error Message-ID: Reply-To: corey@minyard.net References: <20260127-ipmi-v1-0-ba5cc90f516f@debian.org> <20260127135917.1597762-1-corey@minyard.net> <20260127135917.1597762-2-corey@minyard.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Tue, Jan 27, 2026 at 06:40:04AM -0800, Breno Leitao wrote: > On Tue, Jan 27, 2026 at 07:54:39AM -0600, Corey Minyard wrote: > > The analysis from Breno: > > > > When the SMI sender returns an error, smi_work() delivers an error > > response but then jumps back to restart without cleaning up properly: > > > > 1. intf->curr_msg is not cleared, so no new message is pulled > > 2. newmsg still points to the message, causing sender() to be called > > again with the same message > > 3. If sender() fails again, deliver_err_response() is called with > > the same recv_msg that was already queued for delivery > > > > This causes list_add corruption ("list_add double add") because the > > recv_msg is added to the user_msgs list twice. Subsequently, the > > corrupted list leads to use-after-free when the memory is freed and > > reused, and eventually a NULL pointer dereference when accessing > > recv_msg->done. > > > > The buggy sequence: > > > > sender() fails > > -> deliver_err_response(recv_msg) // recv_msg queued for delivery > > -> goto restart // curr_msg not cleared! > > sender() fails again (same message!) > > -> deliver_err_response(recv_msg) // tries to queue same recv_msg > > -> LIST CORRUPTION > > > > Fix this by freeing the message and setting it to NULL on a send error. > > Also, always free the newmsg on a send error, otherwise it will leak. > > > > Reported-by: Breno Leitao > > Fixes: 9cf93a8fa9513 ("ipmi: Allow an SMI sender to return an error") > > Signed-off-by: Corey Minyard > > Reviewed-by: Breno Leitao Thanks, I'll put this into the next tree and send it up after a bit if everything is ok there. -corey > > --breno