diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2025-05-05 17:34:15 +0300 |
|---|---|---|
| committer | Corey Minyard <corey@minyard.net> | 2025-05-07 17:25:48 -0500 |
| commit | fa332f5dc6fc662ad7d3200048772c96b861cf6b (patch) | |
| tree | 073b885611338b20cef6c546c63d0f5d56907f20 /fs/jbd2/commit.c | |
| parent | 971a00454d9604493ecfe4ca8fb8de0fad2863e3 (diff) | |
ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
The "intf" list iterator is an invalid pointer if the correct
"intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on
and invalid pointer will lead to memory corruption.
We don't really need to call atomic_dec() if we haven't called
atomic_add_return() so update the if (intf->in_shutdown) path as well.
Fixes: 8e76741c3d8b ("ipmi: Add a limit on the number of users that may use IPMI")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Message-ID: <aBjMZ8RYrOt6NOgi@stanley.mountain>
Signed-off-by: Corey Minyard <corey@minyard.net>
Diffstat (limited to 'fs/jbd2/commit.c')
0 files changed, 0 insertions, 0 deletions