ipmi/sel: Fix use after free
The message was sometimes re-queued and always freed. Hilarity ensues.
Signed-off-by: Alistair Popple <alistair@popple.id.au>
Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
diff --git a/hw/ipmi/ipmi-sel.c b/hw/ipmi/ipmi-sel.c
index 8851dc3..7007f83 100644
--- a/hw/ipmi/ipmi-sel.c
+++ b/hw/ipmi/ipmi-sel.c
@@ -69,10 +69,10 @@
if (msg->cc == IPMI_LOST_ARBITRATION_ERR)
/* Retry due to SEL erase */
ipmi_queue_msg(msg);
- else
+ else {
opal_elog_complete(msg->user_data, false);
-
- ipmi_free_msg(msg);
+ ipmi_free_msg(msg);
+ }
}
/* Goes through the required steps to add a complete eSEL:
