Commit 3118d7ab authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus-5.17-2' of https://github.com/cminyard/linux-ipmi 

Pull IPMI fixes from Corey Minyard:
 "Fix some issues that were reported.

  This has been in for-next for a bit (longer than the times would
  indicate, I had to rebase to add some text to the headers) and these
  are fixes that need to go in"

* tag 'for-linus-5.17-2' of https://github.com/cminyard/linux-ipmi:
  ipmi:ipmi_ipmb: Fix null-ptr-deref in ipmi_unregister_smi()
  ipmi: When handling send message responses, don't process the message
parents 107c948d 9cc3aac4

drivers/char/ipmi/ipmi_msghandler.c

+6 −1
Original line number Diff line number Diff line
@@ -3677,8 +3677,11 @@ static void cleanup_smi_msgs(struct ipmi_smi *intf) 
void ipmi_unregister_smi(struct ipmi_smi *intf)

{

	struct ipmi_smi_watcher *w;

	int intf_num = intf->intf_num, index;

	int intf_num, index;



	if (!intf)

		return;

	intf_num = intf->intf_num;

	mutex_lock(&ipmi_interfaces_mutex);

	intf->intf_num = -1;

	intf->in_shutdown = true;
@@ -4518,6 +4521,8 @@ static int handle_one_recv_msg(struct ipmi_smi *intf, 
		} else

			/* The message was sent, start the timer. */

			intf_start_seq_timer(intf, msg->msgid);

		requeue = 0;

		goto out;

	} else if (((msg->rsp[0] >> 2) != ((msg->data[0] >> 2) | 1))

		   || (msg->rsp[1] != msg->data[1])) {

		/*

drivers/char/ipmi/ipmi_si_intf.c

+1 −4
Original line number Diff line number Diff line
@@ -2220,10 +2220,7 @@ static void cleanup_one_si(struct smi_info *smi_info) 
		return;



	list_del(&smi_info->link);



	if (smi_info->intf)

	ipmi_unregister_smi(smi_info->intf);



	kfree(smi_info);

}