From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f46.google.com (mail-yx1-f46.google.com [74.125.224.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1AAE3CF688 for ; Thu, 21 May 2026 14:22:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779373379; cv=none; b=bY6Ce2IeDYU+IDEzOISeROZqMWs2/QTKXRnaX8RYNDlotXq9UOLe1s6HM7oHYPrQhGSS4mF1tLhHd7qlDqS3MgL3LhtarvXR60EcSmabSrSkdFpdV+ARZHwa53j6eII9ZZ9kxuU754mqUN/4XEp/vqFSxrD7JfyMr5sitGM+vUk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779373379; c=relaxed/simple; bh=+40JEsgt67rp27HbIogbVE1VNZy4G6PmSZ759DTxeSY=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Y61YH6xZLtTECJvA9bv1VNz7/36jANqxBZ5MoW60KlH8MIStYO+fCOJAjfx4gLFF0z85PhO9GZOOf7la3HPm/QvvP2mdReJFpiHAlzVMFH47yctmAqiMJGpg1ZS+m4ijph30uDc8sp7CZAujhoGghYStzy/o8Cx90PEhAzVRdY4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=minyard.net; spf=pass smtp.mailfrom=minyard.net; dkim=pass (2048-bit key) header.d=minyard.net header.i=@minyard.net header.b=AGU+P38N; arc=none smtp.client-ip=74.125.224.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=minyard.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=minyard.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=minyard.net header.i=@minyard.net header.b="AGU+P38N" Received: by mail-yx1-f46.google.com with SMTP id 956f58d0204a3-6587cee8b57so7211128d50.2 for ; Thu, 21 May 2026 07:22:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=minyard.net; s=google; t=1779373377; x=1779978177; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=mAuZxHOOVqtbe7EvwIW4p7uGjThIX0WoLkEbWijMiq0=; b=AGU+P38N9k015k5sOn8myxZX6ke0r5KbLpHNS+rR9xlH4yKXcTYQrKcBZYPhOw5tPC NSC5fp53w8TU3NXtg+sF+hSvg8bCLKCh79GmaH6HiPxrfruKQqfqXvlwjSuhuHYwUC+4 XhybcR03uTPZsFuJbX982qDna7k7dsSd8g59df92KU3HynL/y2feuWfgi7TL4K/7Sp0M f4j62qrmqg/kMzFrAHtIbq61HX1pAjPoruEtsqoAXMIe7XiazlynsHCT0Xm1FuInADVu 04+zY7tBwEHoK4m9QABG9tex96OvRImCLD9/wcKgnu+gZloMKNmfdJNhgWC2+ld9GJj2 +c3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779373377; x=1779978177; h=in-reply-to:content-disposition:mime-version:references:reply-to :message-id:subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=mAuZxHOOVqtbe7EvwIW4p7uGjThIX0WoLkEbWijMiq0=; b=m+6WpWU2fm26IX0Ma98DFDU3oEQxa2PfRRXS9swuCB8XSIArDr7gau8rymVZ20llqD 2leIws/aQNG7cZ+njmULRiknreMegLM/kitGnKe3Y6L5sE6d+DG5LLKaXjbMz3GNatgo LJOqg0vk9u35n2DBhWraW5FbquIT7rOkUPQxOesT0aU6Xmn78MATHGj/+GkFl2Qs+X+M Dc8FsTGqCl90I7YK4yeM8nG+Dk4H/q+qsi05t1nD7y9zMdESxJSEq/cxF6zOSmraGrbq TrSztodcVoSs/Rsz8PdnGM/hFCfsoCKIvTl1jbGF5WBTDt4ug1nhZ3eS/0WnY2Y9ZZ6m 4Nww== X-Forwarded-Encrypted: i=1; AFNElJ/PWxzzNu+3v4CKGnJSXdltP9ijsPWmpSgR2JuvzXxLvBF+WGbSD+h0V+gpUGvFy4W4Kh0sNHFacae/UBU=@vger.kernel.org X-Gm-Message-State: AOJu0YyTlxg0SBP/Zp2cesgMDPbSegBhjDJvGw9a40sQJ1LWA8TPC7AS R4UCi3lO9OYhCCdMes82AxfcJXuJWC2AKlGnuwmo/gvYKIhNqpaCsZfUSW2PoscUvVY= X-Gm-Gg: Acq92OEj+lifodMXGvqGgheoZn1g/cblR/Jvmb5MFLFHGdPB3C7cGU9XO2LsGL8e/Id B8fbi9OqbD5nTTe9tIqoKUXiFE20JWMqJiyFdTwYVLdOoLnphp1JaTMTYWmLjTKIeXHsTQ9lXJQ zfVB6nJneFA3pDGq0u77kx9pjJWgyNRPdCcaJtMpsR3vHFfi1HwpQm8UeoG8CJTkmYKSZuAhn7b uN9OXHsXr9oxVwFo/pzQArLGfiQyhACNj8BLUodV9OEE3hBhUgPWcfhGSGdoxkOjXWFPzjOv9e0 0J7JtarmEnlxTBr7GJtmBk4nF5XqwkYuG+ru51tkiH0p/GK2CsIW4Qx4FLOT27yqjr8UqJPbilP YXpMDxomyqYrPi/g+KdwYKXbsJT8Ys6cazyEWZKQLoNZyRRXWqejub30TKKydPUhElMABTpJ+Nt 7PC90wuwCJnzlsbaCAiF0J2BCXnoAg8TvezK/jFW48uv/wCk10lMVpPm4SYo2qFiQYhsxw5eX6v kN8b6WrfMTutJAsZ+mxIBKVoiuS8waqid/z X-Received: by 2002:a05:690e:205e:b0:64e:d610:71cf with SMTP id 956f58d0204a3-65eae48a32emr2078881d50.58.1779373376711; Thu, 21 May 2026 07:22:56 -0700 (PDT) Received: from mail.minyard.net ([2001:470:b8f6:1b:6b36:97e1:3f54:e933]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-65ec2009b8dsm222944d50.14.2026.05.21.07.22.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 May 2026 07:22:56 -0700 (PDT) Date: Thu, 21 May 2026 09:22:51 -0500 From: Corey Minyard To: Matt Fleming Cc: Gilles BULOZ , kernel-team@cloudflare.com, Matt Fleming , stable@vger.kernel.org, openipmi-developer@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: Re: [PATCH] ipmi: Fix user refcount underflow in event delivery Message-ID: Reply-To: corey@minyard.net References: <20260521130628.3641050-1-matt@readmodwrite.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260521130628.3641050-1-matt@readmodwrite.com> On Thu, May 21, 2026 at 02:06:27PM +0100, Matt Fleming wrote: > From: Matt Fleming > > ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the > receive message, and ipmi_free_recv_msg() drops it again. If event delivery > fails after allocating receive messages for earlier users, > handle_read_event_rsp() rolls those messages back with > ipmi_free_recv_msg(). > > That rollback path still drops user->refcount explicitly after freeing each > message. The extra put can free a user that remains linked on intf->users, > so later event delivery may dereference a freed user or trip refcount_t's > addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire > another reference. > > Remove the stale explicit put and the now-dead user assignment. Keep the > list_del() and ipmi_free_recv_msg() calls; they are the required rollback > operations. Yes, this is correct. Queued in the ipmi next tree for next release. Thanks, -corey > > Fixes: b52da4054ee0 ("ipmi: Rework user message limit handling") > Cc: stable@vger.kernel.org > Signed-off-by: Matt Fleming > --- > drivers/char/ipmi/ipmi_msghandler.c | 2 -- > 1 file changed, 2 deletions(-) > > diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c > index 869ac87a4b6a..52561a880e54 100644 > --- a/drivers/char/ipmi/ipmi_msghandler.c > +++ b/drivers/char/ipmi/ipmi_msghandler.c > @@ -4477,10 +4477,8 @@ static int handle_read_event_rsp(struct ipmi_smi *intf, > mutex_unlock(&intf->users_mutex); > list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, > link) { > - user = recv_msg->user; > list_del(&recv_msg->link); > ipmi_free_recv_msg(recv_msg); > - kref_put(&user->refcount, free_ipmi_user); > } > /* > * We couldn't allocate memory for the > -- > 2.43.0 >