This is a note to let you know that I've just added the patch titled ipmi: fix use after free in _ipmi_destroy_user() to the 6.0-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ipmi-fix-use-after-free-in-_ipmi_destroy_user.patch and it can be found in the queue-6.0 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From a92ce570c81dc0feaeb12a429b4bc65686d17967 Mon Sep 17 00:00:00 2001 From: Dan Carpenter <error27@xxxxxxxxx> Date: Tue, 15 Nov 2022 16:17:43 +0300 Subject: ipmi: fix use after free in _ipmi_destroy_user() From: Dan Carpenter <error27@xxxxxxxxx> commit a92ce570c81dc0feaeb12a429b4bc65686d17967 upstream. The intf_free() function frees the "intf" pointer so we cannot dereference it again on the next line. Fixes: cbb79863fc31 ("ipmi: Don't allow device module unload when in use") Signed-off-by: Dan Carpenter <error27@xxxxxxxxx> Message-Id: <Y3M8xa1drZv4CToE@kili> Cc: <stable@xxxxxxxxxxxxxxx> # 5.5+ Signed-off-by: Corey Minyard <cminyard@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/char/ipmi/ipmi_msghandler.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -1336,6 +1336,7 @@ static void _ipmi_destroy_user(struct ip unsigned long flags; struct cmd_rcvr *rcvr; struct cmd_rcvr *rcvrs = NULL; + struct module *owner; if (!acquire_ipmi_user(user, &i)) { /* @@ -1398,8 +1399,9 @@ static void _ipmi_destroy_user(struct ip kfree(rcvr); } + owner = intf->owner; kref_put(&intf->refcount, intf_free); - module_put(intf->owner); + module_put(owner); } int ipmi_destroy_user(struct ipmi_user *user) Patches currently in stable-queue which might be from error27@xxxxxxxxx are queue-6.0/ipmi-fix-use-after-free-in-_ipmi_destroy_user.patch