Re: [PATCH] ipmi: fix use after free in _ipmi_destroy_user()

[Corey Minyard <minyard@acm.org>]

On Tue, Nov 15, 2022 at 04:17:43PM +0300, Dan Carpenter wrote:
> The intf_free() function frees the "intf" pointer so we cannot
> dereference it again on the next line.

Thanks.  I will request a backport for 5.5 and later.

> 
> Fixes: cbb79863fc31 ("ipmi: Don't allow device module unload when in use")
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
>  drivers/char/ipmi/ipmi_msghandler.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
> index f6b8ca6df9b5..186f1fee7534 100644
> --- a/drivers/char/ipmi/ipmi_msghandler.c
> +++ b/drivers/char/ipmi/ipmi_msghandler.c
> @@ -1330,6 +1330,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
>  	unsigned long    flags;
>  	struct cmd_rcvr  *rcvr;
>  	struct cmd_rcvr  *rcvrs = NULL;
> +	struct module    *owner;
>  
>  	if (!acquire_ipmi_user(user, &i)) {
>  		/*
> @@ -1392,8 +1393,9 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
>  		kfree(rcvr);
>  	}
>  
> +	owner = intf->owner;
>  	kref_put(&intf->refcount, intf_free);
> -	module_put(intf->owner);
> +	module_put(owner);
>  }
>  
>  int ipmi_destroy_user(struct ipmi_user *user)
> -- 
> 2.35.1
>