| From 53637506884dbd5c91a89b1a3547d99d80f8ed2c Mon Sep 17 00:00:00 2001 |
| From: Yousef Alhouseen <alhouseenyousef@gmail.com> |
| Date: Wed, 24 Jun 2026 19:53:53 +0200 |
| Subject: ipmi: ipmb: validate write message length |
| |
| From: Yousef Alhouseen <alhouseenyousef@gmail.com> |
| |
| commit 53637506884dbd5c91a89b1a3547d99d80f8ed2c upstream. |
| |
| ipmb_write() read message fields before validating the length byte. |
| |
| A zero or short write can read uninitialized stack bytes. |
| |
| A length smaller than the SMBus header underflows the block write length. |
| |
| Require a non-empty buffer and the minimum IPMB request length. |
| |
| Also require the length byte plus payload before parsing the message. |
| |
| Fixes: 51bd6f291583 ("Add support for IPMB driver") |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> |
| Message-ID: <20260624175353.8592-1-alhouseenyousef@gmail.com> |
| Signed-off-by: Corey Minyard <corey@minyard.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/char/ipmi/ipmb_dev_int.c | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/char/ipmi/ipmb_dev_int.c |
| +++ b/drivers/char/ipmi/ipmb_dev_int.c |
| @@ -141,13 +141,14 @@ static ssize_t ipmb_write(struct file *f |
| u8 msg[MAX_MSG_LEN]; |
| ssize_t ret; |
| |
| - if (count > sizeof(msg)) |
| + if (!count || count > sizeof(msg)) |
| return -EINVAL; |
| |
| if (copy_from_user(&msg, buf, count)) |
| return -EFAULT; |
| |
| - if (count < msg[0]) |
| + if (msg[IPMB_MSG_LEN_IDX] < IPMB_REQUEST_LEN_MIN || |
| + count < (size_t)msg[IPMB_MSG_LEN_IDX] + 1) |
| return -EINVAL; |
| |
| rq_sa = GET_7BIT_ADDR(msg[RQ_SA_8BIT_IDX]); |
