On Tue, Jan 27, 2026 at 07:54:39AM -0600, Corey Minyard wrote:
> The analysis from Breno:
>
> When the SMI sender returns an error, smi_work() delivers an error
> response but then jumps back to restart without cleaning up properly:
>
> 1. intf->curr_msg is not cleared, so no new message is pulled
> 2. newmsg still points to the message, causing sender() to be called
> again with the same message
> 3. If sender() fails again, deliver_err_response() is called with
> the same recv_msg that was already queued for delivery
>
> This causes list_add corruption ("list_add double add") because the
> recv_msg is added to the user_msgs list twice. Subsequently, the
> corrupted list leads to use-after-free when the memory is freed and
> reused, and eventually a NULL pointer dereference when accessing
> recv_msg->done.
>
> The buggy sequence:
>
> sender() fails
> -> deliver_err_response(recv_msg) // recv_msg queued for delivery
> -> goto restart // curr_msg not cleared!
> sender() fails again (same message!)
> -> deliver_err_response(recv_msg) // tries to queue same recv_msg
> -> LIST CORRUPTION
>
> Fix this by freeing the message and setting it to NULL on a send error.
> Also, always free the newmsg on a send error, otherwise it will leak.
>
> Reported-by: Breno Leitao <[email protected]>
> Fixes: 9cf93a8fa9513 ("ipmi: Allow an SMI sender to return an error")
> Signed-off-by: Corey Minyard <[email protected]>
Reviewed-by: Breno Leitao <[email protected]>
--breno
_______________________________________________
Openipmi-developer mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openipmi-developer
