On Mon Jun 30, 2025 at 6:10 PM UTC, Greg KH wrote:
On Mon, Jun 30, 2025 at 05:09:02PM +0000, Brendan Jackman wrote:
From: Dan Carpenter dan.carpenter@linaro.org
commit fa332f5dc6fc662ad7d3200048772c96b861cf6b upstream
The "intf" list iterator is an invalid pointer if the correct "intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on and invalid pointer will lead to memory corruption.
We don't really need to call atomic_dec() if we haven't called atomic_add_return() so update the if (intf->in_shutdown) path as well.
Fixes: 8e76741c3d8b ("ipmi: Add a limit on the number of users that may use IPMI") Signed-off-by: Dan Carpenter dan.carpenter@linaro.org Message-ID: aBjMZ8RYrOt6NOgi@stanley.mountain Signed-off-by: Corey Minyard corey@minyard.net Signed-off-by: Brendan Jackman jackmanb@google.com
I have tested this in 6.12 with Google's platform drivers added to reproduce the bug. The bug causes the panic notifier chain to get corrupted leading to a crash. With the fix this goes away.
Applies to 6.6 too but I haven't tested it there.
So what kernels are you wanting this to be applied to?
Right, sorry for the ambiguity. I've just applied the patch to 6.6 and booted QEMU and it worked fine.
I have not reproduced a crash in 6.6 but it's pretty clearly a real bug (it decrements the target of an uninitialized pointer).
So if you're OK with that then please apply to 6.6 and 6.12. Otherwise just 6.12 is fine, I will send another PATCH if I ever hit the issue for real in 6.6.