diff options
| author | Mark Brown <broonie@kernel.org> | 2026-07-23 15:39:43 +0100 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2026-07-23 15:39:43 +0100 |
| commit | 868aa6daa6d714648dfbe126e1d6bc692b2d06dc (patch) | |
| tree | 7b6d3f03c9371a43a4309cecbb6885bc863cf224 | |
| parent | 579854af20cddf9bba6821581c860c97d53baee8 (diff) | |
| parent | 6d920a75df9a83ab096b3cde7a643b656e4fdfeb (diff) | |
| download | linux-next-868aa6daa6d714648dfbe126e1d6bc692b2d06dc.tar.gz linux-next-868aa6daa6d714648dfbe126e1d6bc692b2d06dc.zip | |
Merge branch 'for-next' of https://github.com/cminyard/linux-ipmi.git
| -rw-r--r-- | drivers/char/ipmi/ipmb_dev_int.c | 5 | ||||
| -rw-r--r-- | drivers/char/ipmi/ipmi_msghandler.c | 1 |
2 files changed, 4 insertions, 2 deletions
diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_int.c index 680ff15c30ab..e4c50d9ae3e1 100644 --- a/drivers/char/ipmi/ipmb_dev_int.c +++ b/drivers/char/ipmi/ipmb_dev_int.c @@ -141,13 +141,14 @@ static ssize_t ipmb_write(struct file *file, const char __user *buf, u8 msg[MAX_MSG_LEN]; ssize_t ret; - if (count > sizeof(msg)) + if (!count || count > sizeof(msg)) return -EINVAL; if (copy_from_user(&msg, buf, count)) return -EFAULT; - if (count < msg[0]) + if (msg[IPMB_MSG_LEN_IDX] < IPMB_REQUEST_LEN_MIN || + count < (size_t)msg[IPMB_MSG_LEN_IDX] + 1) return -EINVAL; rq_sa = GET_7BIT_ADDR(msg[RQ_SA_8BIT_IDX]); diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index ab4c85f3d6fe..8d9f2e647d9b 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -3757,6 +3757,7 @@ int ipmi_add_smi(struct module *owner, out_err_bmc_reg: ipmi_bmc_unregister(intf); out_err_started: + intf->in_shutdown = true; if (intf->handlers->shutdown) intf->handlers->shutdown(intf->send_info); out_err: |