diff options
| author | Dan Carpenter <[email protected]> | 2025-05-05 14:34:15 +0000 |
|---|---|---|
| committer | Corey Minyard <[email protected]> | 2025-05-07 22:25:48 +0000 |
| commit | fa332f5dc6fc662ad7d3200048772c96b861cf6b (patch) | |
| tree | 073b885611338b20cef6c546c63d0f5d56907f20 /rust/helpers/platform.c | |
| parent | ipmi:watchdog: Use the new interface for panic messages (diff) | |
| download | kernel-fa332f5dc6fc662ad7d3200048772c96b861cf6b.tar.gz kernel-fa332f5dc6fc662ad7d3200048772c96b861cf6b.zip | |
ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
The "intf" list iterator is an invalid pointer if the correct
"intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on
and invalid pointer will lead to memory corruption.
We don't really need to call atomic_dec() if we haven't called
atomic_add_return() so update the if (intf->in_shutdown) path as well.
Fixes: 8e76741c3d8b ("ipmi: Add a limit on the number of users that may use IPMI")
Signed-off-by: Dan Carpenter <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Corey Minyard <[email protected]>
Diffstat (limited to 'rust/helpers/platform.c')
0 files changed, 0 insertions, 0 deletions