Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f66c6e6a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus-4.7-2' of git://git.code.sf.net/p/openipmi/linux-ipmi 

Pull ipmi bugfix from Corey Minyard:
 "Fix a fairly significant ipmi list bug

  This bug could cause lists to be corrupted"

* tag 'for-linus-4.7-2' of git://git.code.sf.net/p/openipmi/linux-ipmi:
  ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg()
parents 78ae255f ae4ea9a2

drivers/char/ipmi/ipmi_msghandler.c

+6 −2
Original line number Diff line number Diff line
@@ -3820,6 +3820,7 @@ static void handle_new_recv_msgs(ipmi_smi_t intf) 
	while (!list_empty(&intf->waiting_rcv_msgs)) {

		smi_msg = list_entry(intf->waiting_rcv_msgs.next,

				     struct ipmi_smi_msg, link);

		list_del(&smi_msg->link);

		if (!run_to_completion)

			spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,

					       flags);
@@ -3829,11 +3830,14 @@ static void handle_new_recv_msgs(ipmi_smi_t intf) 
		if (rv > 0) {

			/*

			 * To preserve message order, quit if we

			 * can't handle a message.

			 * can't handle a message.  Add the message

			 * back at the head, this is safe because this

			 * tasklet is the only thing that pulls the

			 * messages.

			 */

			list_add(&smi_msg->link, &intf->waiting_rcv_msgs);

			break;

		} else {

			list_del(&smi_msg->link);

			if (rv == 0)

				/* Message handled */

				ipmi_free_smi_msg(smi_msg);