Re: [PATCH 1/2] ipmi: Fix use-after-free and list corruption on sender error

[Corey Minyard <corey@minyard.net>]

On Tue, Jan 27, 2026 at 06:40:04AM -0800, Breno Leitao wrote:
> On Tue, Jan 27, 2026 at 07:54:39AM -0600, Corey Minyard wrote:
> > The analysis from Breno:
> > 
> > When the SMI sender returns an error, smi_work() delivers an error
> > response but then jumps back to restart without cleaning up properly:
> > 
> > 1. intf->curr_msg is not cleared, so no new message is pulled
> > 2. newmsg still points to the message, causing sender() to be called
> >    again with the same message
> > 3. If sender() fails again, deliver_err_response() is called with
> >    the same recv_msg that was already queued for delivery
> > 
> > This causes list_add corruption ("list_add double add") because the
> > recv_msg is added to the user_msgs list twice. Subsequently, the
> > corrupted list leads to use-after-free when the memory is freed and
> > reused, and eventually a NULL pointer dereference when accessing
> > recv_msg->done.
> > 
> > The buggy sequence:
> > 
> >   sender() fails
> >     -> deliver_err_response(recv_msg)  // recv_msg queued for delivery
> >     -> goto restart                    // curr_msg not cleared!
> >   sender() fails again (same message!)
> >     -> deliver_err_response(recv_msg)  // tries to queue same recv_msg
> >     -> LIST CORRUPTION
> > 
> > Fix this by freeing the message and setting it to NULL on a send error.
> > Also, always free the newmsg on a send error, otherwise it will leak.
> > 
> > Reported-by: Breno Leitao <leitao@debian.org>
> > Fixes: 9cf93a8fa9513 ("ipmi: Allow an SMI sender to return an error")
> > Signed-off-by: Corey Minyard <corey@minyard.net>
> 
> Reviewed-by: Breno Leitao <leitao@debian.org>

Thanks, I'll put this into the next tree and send it up after a bit
if everything is ok there.

-corey

> 
> --breno