ipmi_add_smi() creates the nr_users and nr_msgs files before trying to
create the maintenance_mode file. If that last creation fails, the error
path removes only nr_users before dropping the final reference to the
interface.

Remove nr_msgs as well so no sysfs attribute embedded in the freed
interface remains registered.

Fixes: 627118470fcc ("ipmi: Add a maintenance mode sysfs file")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 drivers/char/ipmi/ipmi_msghandler.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index ab4c85f3d6fe..546b7ca8d68e 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3740,6 +3740,7 @@ int ipmi_add_smi(struct module         *owner,
 	sysfs_attr_init(&intf->maintenance_mode_devattr.attr);
 	rv = device_create_file(intf->si_dev, &intf->maintenance_mode_devattr);
 	if (rv) {
+		device_remove_file(intf->si_dev, &intf->nr_msgs_devattr);
 		device_remove_file(intf->si_dev, &intf->nr_users_devattr);
 		goto out_err_bmc_reg;
 	}
-- 
2.43.0

On Sun, Aug 02, 2026 at 09:55:50PM -0400, Yuho Choi wrote:
> ipmi_add_smi() creates the nr_users and nr_msgs files before trying to
> create the maintenance_mode file. If that last creation fails, the error
> path removes only nr_users before dropping the final reference to the
> interface.
> 
> Remove nr_msgs as well so no sysfs attribute embedded in the freed
> interface remains registered.

Thanks, this is queued for next release.

I've also copied stable for a backport to 6.18.

-corey

> 
> Fixes: 627118470fcc ("ipmi: Add a maintenance mode sysfs file")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> ---
>  drivers/char/ipmi/ipmi_msghandler.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
> index ab4c85f3d6fe..546b7ca8d68e 100644
> --- a/drivers/char/ipmi/ipmi_msghandler.c
> +++ b/drivers/char/ipmi/ipmi_msghandler.c
> @@ -3740,6 +3740,7 @@ int ipmi_add_smi(struct module         *owner,
>  	sysfs_attr_init(&intf->maintenance_mode_devattr.attr);
>  	rv = device_create_file(intf->si_dev, &intf->maintenance_mode_devattr);
>  	if (rv) {
> +		device_remove_file(intf->si_dev, &intf->nr_msgs_devattr);
>  		device_remove_file(intf->si_dev, &intf->nr_users_devattr);
>  		goto out_err_bmc_reg;
>  	}
> -- 
> 2.43.0
>