iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/char/ipmi
History
Dan Carpenter 898d200148 ipmi: ssif_bmc: prevent integer overflow on 32bit systems 
[ Upstream commit 0627cef36145c9ff9845bdfd7ddf485bbac1f981 ]

There are actually two bugs here.  First, we need to ensure that count
is at least sizeof(u32) or msg.len will be uninitialized data.

The "msg.len" variable is a u32 that comes from the user.  On 32bit
systems the "sizeof_field(struct ipmi_ssif_msg, len) + msg.len"
addition can overflow if "msg.len" is greater than U32_MAX - 4.

Valid lengths for "msg.len" are 1-254.  Add a check for that to
prevent the integer overflow.

Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Message-Id: <1431ca2e-4e9c-4520-bfc0-6879313c30e9@moroto.mountain>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-08-03 08:59:55 +02:00
..
bt-bmc.c
ipmi: bt-bmc: Convert to platform remove callback returning void
2024-04-17 14:55:04 -05:00
ipmb_dev_int.c
ipmi: Switch i2c drivers back to use .probe()
2023-05-25 18:48:06 -05:00
ipmi_bt_sm.c
ipmi: Clean up some printks
2020-09-15 09:57:45 -05:00
ipmi_devintf.c
ipmi: make ipmi_class a static const structure
2023-06-20 09:49:08 -05:00
ipmi_dmi.c
ipmi_si: Rework some include files
2019-08-02 07:25:03 -05:00
ipmi_dmi.h
ipmi_si: Rework some include files
2019-08-02 07:25:03 -05:00
ipmi_ipmb.c
ipmi: Switch i2c drivers back to use .probe()
2023-05-25 18:48:06 -05:00
ipmi_kcs_sm.c
ipmi: fix msg stack when IPMI is disconnected
2022-10-17 09:51:27 -05:00
ipmi_msghandler.c
ipmi: Convert from tasklet to BH workqueue
2024-04-17 14:54:45 -05:00
ipmi_plat_data.c
ipmi: Handle device properties with software node API
2021-03-10 19:00:02 -06:00
ipmi_plat_data.h
ipmi: Add the i2c-addr property for SSIF interfaces
2019-04-24 09:02:53 -05:00
ipmi_powernv.c
ipmi: ipmi_powernv: Convert to platform remove callback returning void
2024-04-17 14:55:04 -05:00
ipmi_poweroff.c
char-misc: Remove the now superfluous sentinel element from ctl_table array
2023-10-11 12:16:13 -07:00
ipmi_si_hardcode.c
ipmi: Use regspacings passed as a module parameter
2023-12-19 06:32:27 -06:00
ipmi_si_hotmod.c
ipmi_si: Join string literals back
2021-04-02 12:53:42 -05:00
ipmi_si_intf.c
char: ipmi: handle HAS_IOPORT dependencies
2024-04-17 14:55:04 -05:00
ipmi_si_mem_io.c
ipmi_si: Rework some include files
2019-08-02 07:25:03 -05:00
ipmi_si_parisc.c
parisc: Make struct parisc_driver::remove() return void
2021-08-30 10:18:25 +02:00
ipmi_si_pci.c
char: ipmi: handle HAS_IOPORT dependencies
2024-04-17 14:55:04 -05:00
ipmi_si_platform.c
ipmi: ipmi_si_platform: Convert to platform remove callback returning void
2024-04-17 14:55:04 -05:00
ipmi_si_port_io.c
ipmi_si: Rework some include files
2019-08-02 07:25:03 -05:00
ipmi_si_sm.h
ipmi_si: Rework some include files
2019-08-02 07:25:03 -05:00
ipmi_si.h
parisc: Make struct parisc_driver::remove() return void
2021-08-30 10:18:25 +02:00
ipmi_smic_sm.c
ipmi: Clean up some printks
2020-09-15 09:57:45 -05:00
ipmi_ssif.c
ipmi: ipmi_ssif: Convert to platform remove callback returning void
2024-04-17 14:55:04 -05:00
ipmi_watchdog.c
ipmi_watchdog: Fix read syscall not responding to signals during sleep
2023-05-18 17:31:31 -05:00
Kconfig
ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it
2023-03-02 16:14:15 -06:00
kcs_bmc_aspeed.c
ipmi: kcs_bmc_aspeed: Convert to platform remove callback returning void
2024-04-17 14:55:04 -05:00
kcs_bmc_cdev_ipmi.c
ipmi: Add __init/__exit annotations to module init/exit funcs
2022-09-22 10:55:46 -05:00
kcs_bmc_client.h
ipmi: kcs_bmc: Allow clients to control KCS IRQ state
2021-06-21 19:50:28 -05:00
kcs_bmc_device.h
ipmi: kcs_bmc: Allow clients to control KCS IRQ state
2021-06-21 19:50:28 -05:00
kcs_bmc_npcm7xx.c
ipmi: kcs_bmc_npcm7xx: Convert to platform remove callback returning void
2024-04-17 14:55:04 -05:00
kcs_bmc_serio.c
ipmi: Add __init/__exit annotations to module init/exit funcs
2022-09-22 10:55:46 -05:00
kcs_bmc.c
ipmi: fix potential deadlock on &kcs_bmc->lock
2023-07-04 09:22:45 -05:00
kcs_bmc.h
ipmi: kcs_bmc: Allow clients to control KCS IRQ state
2021-06-21 19:50:28 -05:00
Makefile
char: ipmi: handle HAS_IOPORT dependencies
2024-04-17 14:55:04 -05:00
ssif_bmc.c
ipmi: ssif_bmc: prevent integer overflow on 32bit systems
2024-08-03 08:59:55 +02:00