On Tue, Jan 27, 2026 at 06:40:04AM -0800, Breno Leitao wrote:
> On Tue, Jan 27, 2026 at 07:54:39AM -0600, Corey Minyard wrote:
> > The analysis from Breno:
> >
> > When the SMI sender returns an error, smi_work() delivers an error
> > response but then jumps back to restart without cleaning up properly:
> >
> > 1. intf->curr_msg is not cleared, so no new message is pulled
> > 2. newmsg still points to the message, causing sender() to be called
> > again with the same message
> > 3. If sender() fails again, deliver_err_response() is called with
> > the same recv_msg that was already queued for delivery
> >
> > This causes list_add corruption ("list_add double add") because the
> > recv_msg is added to the user_msgs list twice. Subsequently, the
> > corrupted list leads to use-after-free when the memory is freed and
> > reused, and eventually a NULL pointer dereference when accessing
> > recv_msg->done.
> >
> > The buggy sequence:
> >
> > sender() fails
> > -> deliver_err_response(recv_msg) // recv_msg queued for delivery
> > -> goto restart // curr_msg not cleared!
> > sender() fails again (same message!)
> > -> deliver_err_response(recv_msg) // tries to queue same recv_msg
> > -> LIST CORRUPTION
> >
> > Fix this by freeing the message and setting it to NULL on a send error.
> > Also, always free the newmsg on a send error, otherwise it will leak.
> >
> > Reported-by: Breno Leitao <[email protected]>
> > Fixes: 9cf93a8fa9513 ("ipmi: Allow an SMI sender to return an error")
> > Signed-off-by: Corey Minyard <[email protected]>
>
> Reviewed-by: Breno Leitao <[email protected]>
Thanks, I'll put this into the next tree and send it up after a bit
if everything is ok there.
-corey
>
> --breno
_______________________________________________
Openipmi-developer mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openipmi-developer
