From nobody Tue Jun 9 00:54:57 2026 Received: from va-1-111.ptr.blmpb.com (va-1-111.ptr.blmpb.com [209.127.230.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5FCBE38E126 for ; Mon, 25 May 2026 06:32:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.127.230.111 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779690777; cv=none; b=ZhKcgybYLZ5UlbwSy5Y0wEyGy+Iv1cm/XgKms6ggop8SkvGfdYtU0iYpGrfB9zZppePCKyunbYBm2tTuY3COvoEXkyLJGWbJA9MePH5FL7awFD5kCN53rAKq0G+xL0+hv0oPegDY+ek4XcGtG9Eb86ZXAl+bs4hWH1BfZ9OAzlI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779690777; c=relaxed/simple; bh=PT/6j//cUYRye2KeDUxQ/fGyunYOhu9WR8MQyypHQ5U=; h=Content-Type:Cc:From:Mime-Version:To:Subject:Date:Message-Id; b=oGut5LG4b8mIBt2d2CtCp6nV3M3yU07nqWJD4fzKKV/QYpYs3MD1HEOjGkZ4hliXgEIEcJx9vMMY7owG6PP5CHQEFck4iY4UpjnDGqi9X997BDtEcmAtGnz9pwznfiMql4EY9SRO3BAd+dXApn5YMrC05xY4+9TOmUkAW47nOAE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=bLzA+2px; arc=none smtp.client-ip=209.127.230.111 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="bLzA+2px" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=2212171451; d=bytedance.com; t=1779690769; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=07bFtTnXwilNmnh/+5dheCThlPykU801eesxhhjJU/E=; b=bLzA+2pxZDL84O9JAYnS0CuQkGqmhUu+9Yj+GKeZHnbZBg4+avzqv9GZ9QSxQbllzX5Te4 0e53LIfJOrDruxTuagexfxVRRejl17FLnoAFLhRqcMvq7VzEw+axa0D2X4Q6aU9v0yCSrH QQgZ1syYYdeP9xGXc+cbqPTPNeXQjG9eF3iaYGWFotO8O0IM+lk+Gi5zUBJkvoh4KcqoUQ 2oIygkc97Ruiuh/r1LujNSbsJH4wtOQ2xwLZ1Q42kpw7t4Ua+k/sF1qjpf4wkr7qXLbe03 CDPWqs2eNdumpUCcAt+mcJNK9xVw/awuSQMY9h2k2SaJs7WIPJA77f2A1ru70A== X-Original-From: Rui Qi Content-Transfer-Encoding: quoted-printable Cc: , , , "Greg Kroah-Hartman" , "Rui Qi" From: "Rui Qi" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 To: "Corey Minyard" Subject: [PATCH v2] ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp X-Mailer: git-send-email 2.20.1 X-Lms-Return-Path: Date: Mon, 25 May 2026 14:32:35 +0800 Message-Id: <20260525063235.990101-1-qirui.001@bytedance.com> Content-Type: text/plain; charset="utf-8" From: "Rui Qi" Fix a bug where rcu_read_unlock() was used instead of srcu_read_unlock() in handle_read_event_rsp() when ipmi_alloc_recv_msg() fails. This mismatch leads to an SRCU read-side critical section imbalance: the entry uses srcu_read_lock(&intf->users_srcu) but the error path incorrectly calls rcu_read_unlock(), which is a no-op for SRCU and leaves the SRCU lock held. The offending code was restructured in mainline by commit 3be997d5a64a ("ipmi:msghandler: Remove srcu from the ipmi user structure"), which replaced the SRCU locking with a mutex in this function, effectively eliminating the mismatch. However, that commit is part of a larger SRCU removal series that is not suitable for stable backport. This minimal fix addresses the SRCU imbalance for 6.12 and earlier stable branches that still carry the original locking scheme. Fixes: e86ee2d44b44 ("ipmi: Rework locking and shutdown for hot remove") Cc: stable@vger.kernel.org Signed-off-by: Rui Qi Acked-by: Corey Minyard --- drivers/char/ipmi/ipmi_msghandler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_m= sghandler.c index 188722ec0337..41ae4dac4eeb 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -4395,7 +4395,7 @@ static int handle_read_event_rsp(struct ipmi_smi *int= f, recv_msg =3D ipmi_alloc_recv_msg(user); if (IS_ERR(recv_msg)) { - rcu_read_unlock(); + srcu_read_unlock(&intf->users_srcu, index); list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) { list_del(&recv_msg->link); -- 2.20.1