On Tue, Aug 25, 2026 at 11:46:29PM +0000, Yifei Gao wrote:
> Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the
> ipmi_interfaces list") dropped the synchronize_rcu() between unlinking
> the command receivers from intf->cmd_rcvrs and freeing them, updating
> only the comment that explains why the barrier is needed.
>
> The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr()
> walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows
> rcvr->user from that lookup within the same read-side section. Without
> the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a
> reader still holds a pointer to it, causing a use-after-free.
>
> The rework only made srcu unnecessary for the interfaces list; the
> cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu()
> before freeing the receivers.
Yes, looks good and passes tests, it's in my next tree.
-corey
>
> Fixes: 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces
> list")
> Cc: [email protected]
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Yifei Gao <[email protected]>
> ---
> drivers/char/ipmi/ipmi_msghandler.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/char/ipmi/ipmi_msghandler.c
> b/drivers/char/ipmi/ipmi_msghandler.c
> index ab4c85f3d6fe..3f4018194df8 100644
> --- a/drivers/char/ipmi/ipmi_msghandler.c
> +++ b/drivers/char/ipmi/ipmi_msghandler.c
> @@ -1391,6 +1391,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
> }
> }
> mutex_unlock(&intf->cmd_rcvrs_mutex);
> + synchronize_rcu();
> while (rcvrs) {
> rcvr = rcvrs;
> rcvrs = rcvr->next;
> --
> 2.43.0
>
_______________________________________________
Openipmi-developer mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openipmi-developer
