mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-09 05:31:17 -04:00
Code Issues Packages Projects Releases Wiki Activity

ipmi:msghandler: Don't acquire a user refcount for queued messages

Browse Source 
Messages already have a refcount for the user, so there's no need to
account for a new one.

As part of this, grab a refcount to the interface when processing
received messages.  The messages can be freed there, cause the user
then the interface to be freed.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
This commit is contained in:
Corey Minyard
2025-03-21 15:12:06 -05:00
parent 84fe1ebcc9
commit ff2d2bc9f2
1 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
drivers/char/ipmi/ipmi_msghandler.c
View File

@@ -958,20 +958,14 @@ static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
ipmi_free_recv_msg(msg);
atomic_dec(&msg->user->nr_msgs);
} else {
struct ipmi_user *user = acquire_ipmi_user(msg->user);
if (user) {
/* Deliver it in smi_work. */
mutex_lock(&intf->user_msgs_mutex);
list_add_tail(&msg->link, &intf->user_msgs);
mutex_unlock(&intf->user_msgs_mutex);
queue_work(system_wq, &intf->smi_work);
/* User release will happen in the work queue. */
} else {
/* User went away, give up. */
ipmi_free_recv_msg(msg);
rv = -EINVAL;
}
/*
* Deliver it in smi_work. The message will hold a
* refcount to the user.
*/
mutex_lock(&intf->user_msgs_mutex);
list_add_tail(&msg->link, &intf->user_msgs);
mutex_unlock(&intf->user_msgs_mutex);
queue_work(system_wq, &intf->smi_work);
}
return rv;
@@ -4827,6 +4821,13 @@ static void smi_work(struct work_struct *t)
mutex_unlock(&intf->users_mutex);
}
/*
* Freeing the message can cause a user to be released, which
* can then cause the interface to be freed. Make sure that
* doesn't happen until we are ready.
*/
kref_get(&intf->refcount);
mutex_lock(&intf->user_msgs_mutex);
list_for_each_entry_safe(msg, msg2, &intf->user_msgs, link) {
struct ipmi_user *user = msg->user;
@@ -4834,9 +4835,10 @@ static void smi_work(struct work_struct *t)
list_del(&msg->link);
atomic_dec(&user->nr_msgs);
user->handler->ipmi_recv_hndl(msg, user->handler_data);
release_ipmi_user(user);
}
mutex_unlock(&intf->user_msgs_mutex);
kref_put(&intf->refcount, intf_free);
}
/* Handle a new message from the lower layer. */