Dan Carpenter fa332f5dc6 ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() ...

The "intf" list iterator is an invalid pointer if the correct
"intf->intf_num" is not found.  Calling atomic_dec(&intf->nr_users) on
and invalid pointer will lead to memory corruption.

We don't really need to call atomic_dec() if we haven't called
atomic_add_return() so update the if (intf->in_shutdown) path as well.

Fixes: 8e76741c3d ("ipmi: Add a limit on the number of users that may use IPMI")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Message-ID: <aBjMZ8RYrOt6NOgi@stanley.mountain>
Signed-off-by: Corey Minyard <corey@minyard.net>

2025-05-07 17:25:48 -05:00

..

bt-bmc.c

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05 10:30:12 +02:00

ipmb_dev_int.c

char:ipmi: Fix a not-used variable on a non-ACPI system

2024-12-22 14:57:47 -06:00

ipmi_bt_sm.c

ipmi: Clean up some printks

2020-09-15 09:57:45 -05:00

ipmi_devintf.c

ipmi: make ipmi_destroy_user() return void

2025-01-02 21:11:52 -06:00

ipmi_dmi.c

ipmi_si: Rework some include files

2019-08-02 07:25:03 -05:00

ipmi_dmi.h

ipmi_si: Rework some include files

2019-08-02 07:25:03 -05:00

ipmi_ipmb.c

ipmi: Drop explicit initialization of struct i2c_device_id::driver_data to 0

2024-07-08 15:05:18 -05:00

ipmi_kcs_sm.c

ipmi: fix msg stack when IPMI is disconnected

2022-10-17 09:51:27 -05:00

ipmi_msghandler.c

ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()

2025-05-07 17:25:48 -05:00

ipmi_plat_data.c

ipmi: Handle device properties with software node API

2021-03-10 19:00:02 -06:00

ipmi_plat_data.h

ipmi: Add the i2c-addr property for SSIF interfaces

2019-04-24 09:02:53 -05:00

ipmi_powernv.c

Get rid of 'remove_new' relic from platform driver struct

2024-12-01 15:12:43 -08:00

ipmi_poweroff.c

treewide: const qualify ctl_tables where applicable

2025-01-28 13:48:37 +01:00

ipmi_si_hardcode.c

ipmi: Use regspacings passed as a module parameter

2023-12-19 06:32:27 -06:00

ipmi_si_hotmod.c

ipmi_si: Join string literals back

2021-04-02 12:53:42 -05:00

ipmi_si_intf.c

ipmi:si: Rework startup of IPMI devices

2025-05-07 17:25:48 -05:00

ipmi_si_mem_io.c

ipmi_si: Rework some include files

2019-08-02 07:25:03 -05:00

ipmi_si_parisc.c

ipmi:si: Move SI type information into an info structure

2025-05-07 17:25:47 -05:00

ipmi_si_pci.c

ipmi:si: Move SI type information into an info structure

2025-05-07 17:25:47 -05:00

ipmi_si_platform.c

ipmi:si: Move SI type information into an info structure

2025-05-07 17:25:47 -05:00

ipmi_si_port_io.c

ipmi_si: Rework some include files

2019-08-02 07:25:03 -05:00

ipmi_si_sm.h

ipmi_si: Rework some include files

2019-08-02 07:25:03 -05:00

ipmi_si.h

ipmi:si: Move SI type information into an info structure

2025-05-07 17:25:47 -05:00

ipmi_smic_sm.c

ipmi: Clean up some printks

2020-09-15 09:57:45 -05:00

ipmi_ssif.c

ipmi:ssif: Fix a shutdown race

2025-05-07 17:25:48 -05:00

ipmi_watchdog.c

ipmi:watchdog: Use the new interface for panic messages

2025-05-07 17:25:48 -05:00

Kconfig

ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it

2023-03-02 16:14:15 -06:00

kcs_bmc_aspeed.c

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05 10:30:12 +02:00

kcs_bmc_cdev_ipmi.c

ipmi: Add __init/__exit annotations to module init/exit funcs

2022-09-22 10:55:46 -05:00

kcs_bmc_client.h

ipmi: kcs_bmc: Allow clients to control KCS IRQ state

2021-06-21 19:50:28 -05:00

kcs_bmc_device.h

ipmi: kcs_bmc: Allow clients to control KCS IRQ state

2021-06-21 19:50:28 -05:00

kcs_bmc_npcm7xx.c

Get rid of 'remove_new' relic from platform driver struct

2024-12-01 15:12:43 -08:00

kcs_bmc_serio.c

ipmi: Add __init/__exit annotations to module init/exit funcs

2022-09-22 10:55:46 -05:00

kcs_bmc.c

ipmi: fix potential deadlock on &kcs_bmc->lock

2023-07-04 09:22:45 -05:00

kcs_bmc.h

ipmi: kcs_bmc: Allow clients to control KCS IRQ state

2021-06-21 19:50:28 -05:00

Makefile

char: ipmi: handle HAS_IOPORT dependencies

2024-04-17 14:55:04 -05:00

ssif_bmc.c

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05 10:30:12 +02:00