There is a use-after-free vulnerability in the ibmpex driver where the driver frees the sensors array while sysfs read operations via ibmpex_show_sensor() are still in progress.

Fix this by reordering cleanup operations in ibmpex_bmc_delete().

Reported-by: Yuhao Jiang danisjiang@gmail.com Reported-by: Junrui Luo moonafterrain@outlook.com Fixes: 57c7c3a0fdea ("hwmon: IBM power meter driver") Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo moonafterrain@outlook.com --- drivers/hwmon/ibmpex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c index 228c5f6c6f38..578549f44154 100644 --- a/drivers/hwmon/ibmpex.c +++ b/drivers/hwmon/ibmpex.c @@ -508,6 +508,7 @@ static void ibmpex_bmc_delete(struct ibmpex_bmc_data *data) { int i, j;

+ hwmon_device_unregister(data->hwmon_dev); device_remove_file(data->bmc_device, &sensor_dev_attr_reset_high_low.dev_attr); device_remove_file(data->bmc_device, &dev_attr_name.attr); @@ -522,7 +523,6 @@ static void ibmpex_bmc_delete(struct ibmpex_bmc_data *data)

list_del(&data->list); dev_set_drvdata(data->bmc_device, NULL); - hwmon_device_unregister(data->hwmon_dev); ipmi_destroy_user(data->user); kfree(data->sensors); kfree(data);

--- base-commit: cfd4039213e7b5a828c5b78e1b5235cac91af53d change-id: 20251218-fixes-25f078f93a1c

Best regards,