[PATCH] ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()

[PATCH] ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()

[Yifei Gao]

Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the
ipmi_interfaces list") dropped the synchronize_rcu() between unlinking
the command receivers from intf->cmd_rcvrs and freeing them, updating
only the comment that explains why the barrier is needed.

The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr()
walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows
rcvr->user from that lookup within the same read-side section. Without
the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a
reader still holds a pointer to it, causing a use-after-free.

The rework only made srcu unnecessary for the interfaces list; the
cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu()
before freeing the receivers.

Fixes: 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Yifei Gao <gyf161023@gmail.com>
---
 drivers/char/ipmi/ipmi_msghandler.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index ab4c85f3d6fe..3f4018194df8 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -1391,6 +1391,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
 		}
 	}
 	mutex_unlock(&intf->cmd_rcvrs_mutex);
+	synchronize_rcu();
 	while (rcvrs) {
 		rcvr = rcvrs;
 		rcvrs = rcvr->next;
-- 
2.43.0

Re: [PATCH] ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()

[Corey Minyard]

On Tue, Aug 25, 2026 at 11:46:29PM +0000, Yifei Gao wrote:
> Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the
> ipmi_interfaces list") dropped the synchronize_rcu() between unlinking
> the command receivers from intf->cmd_rcvrs and freeing them, updating
> only the comment that explains why the barrier is needed.
> 
> The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr()
> walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows
> rcvr->user from that lookup within the same read-side section. Without
> the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a
> reader still holds a pointer to it, causing a use-after-free.
> 
> The rework only made srcu unnecessary for the interfaces list; the
> cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu()
> before freeing the receivers.

Yes, looks good and passes tests, it's in my next tree.

-corey

> 
> Fixes: 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Yifei Gao <gyf161023@gmail.com>
> ---
>  drivers/char/ipmi/ipmi_msghandler.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
> index ab4c85f3d6fe..3f4018194df8 100644
> --- a/drivers/char/ipmi/ipmi_msghandler.c
> +++ b/drivers/char/ipmi/ipmi_msghandler.c
> @@ -1391,6 +1391,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
>  		}
>  	}
>  	mutex_unlock(&intf->cmd_rcvrs_mutex);
> +	synchronize_rcu();
>  	while (rcvrs) {
>  		rcvr = rcvrs;
>  		rcvrs = rcvr->next;
> -- 
> 2.43.0
>