diff options
| author | Alistair Popple <alistair@popple.id.au> | 2015-06-18 11:00:34 +1000 |
|---|---|---|
| committer | Stewart Smith <stewart@linux.vnet.ibm.com> | 2015-06-18 14:51:55 +1000 |
| commit | 092d2a8e58cad4c9cac3dc573f5af6409d2d1ce6 (patch) | |
| tree | 491e518cd7d23ff2009366794a3f165e1b7eeb4f /hw/ipmi | |
| parent | 89b588267fe9233d6bdb26fa8671f41f79fc690b (diff) | |
| download | skiboot-092d2a8e58cad4c9cac3dc573f5af6409d2d1ce6.zip skiboot-092d2a8e58cad4c9cac3dc573f5af6409d2d1ce6.tar.gz skiboot-092d2a8e58cad4c9cac3dc573f5af6409d2d1ce6.tar.bz2 | |
ipmi/sel: Fix use after free
The message was sometimes re-queued and always freed. Hilarity ensues.
Signed-off-by: Alistair Popple <alistair@popple.id.au>
Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
Diffstat (limited to 'hw/ipmi')
| -rw-r--r-- | hw/ipmi/ipmi-sel.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/hw/ipmi/ipmi-sel.c b/hw/ipmi/ipmi-sel.c index 8851dc3..7007f83 100644 --- a/hw/ipmi/ipmi-sel.c +++ b/hw/ipmi/ipmi-sel.c @@ -69,10 +69,10 @@ static void ipmi_elog_error(struct ipmi_msg *msg) if (msg->cc == IPMI_LOST_ARBITRATION_ERR) /* Retry due to SEL erase */ ipmi_queue_msg(msg); - else + else { opal_elog_complete(msg->user_data, false); - - ipmi_free_msg(msg); + ipmi_free_msg(msg); + } } /* Goes through the required steps to add a complete eSEL: |