Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list") dropped the synchronize_rcu() between unlinking the command receivers from intf->cmd_rcvrs and freeing them, updating only the comment that explains why the barrier is needed. The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr() walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows rcvr->user from that lookup within the same read-side section. Without the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a reader still holds a pointer to it, causing a use-after-free. The rework only made srcu unnecessary for the interfaces list; the cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu() before freeing the receivers.
Unified · Split
| @@ -1391,6 +1391,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user) · 1390 unmodified lines | |||
| 1391 | } | 1391 | } |
| 1392 | } | 1392 | } |
| 1393 | mutex_unlock(&intf->cmd_rcvrs_mutex); | 1393 | mutex_unlock(&intf->cmd_rcvrs_mutex); |
| 1394 | synchronize_rcu(); | ||
| 1394 | while (rcvrs) { | 1395 | while (rcvrs) { |
| 1395 | rcvr = rcvrs; | 1396 | rcvr = rcvrs; |
| 1396 | rcvrs = rcvr->next; | 1397 | rcvrs = rcvr->next; |