diff options
| author | Mark Brown <broonie@kernel.org> | 2026-07-03 16:21:42 +0100 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2026-07-03 16:21:42 +0100 |
| commit | d9f4319f16a163b861d4c56974aeea73c3e76047 (patch) | |
| tree | e7d322ab4e7bf82a93522355cbfbb441e2eee316 | |
| parent | 715af26d71ed21e65f47fd6770392b37e77dba9c (diff) | |
| parent | 6d920a75df9a83ab096b3cde7a643b656e4fdfeb (diff) | |
| download | linux-next-d9f4319f16a163b861d4c56974aeea73c3e76047.tar.gz linux-next-d9f4319f16a163b861d4c56974aeea73c3e76047.zip | |
Merge branch 'for-next' of https://github.com/cminyard/linux-ipmi.git
| -rw-r--r-- | drivers/char/ipmi/ipmb_dev_int.c | 5 | ||||
| -rw-r--r-- | drivers/char/ipmi/ipmi_msghandler.c | 1 |
2 files changed, 4 insertions, 2 deletions
diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_int.c index 680ff15c30ab..e4c50d9ae3e1 100644 --- a/drivers/char/ipmi/ipmb_dev_int.c +++ b/drivers/char/ipmi/ipmb_dev_int.c @@ -141,13 +141,14 @@ static ssize_t ipmb_write(struct file *file, const char __user *buf, u8 msg[MAX_MSG_LEN]; ssize_t ret; - if (count > sizeof(msg)) + if (!count || count > sizeof(msg)) return -EINVAL; if (copy_from_user(&msg, buf, count)) return -EFAULT; - if (count < msg[0]) + if (msg[IPMB_MSG_LEN_IDX] < IPMB_REQUEST_LEN_MIN || + count < (size_t)msg[IPMB_MSG_LEN_IDX] + 1) return -EINVAL; rq_sa = GET_7BIT_ADDR(msg[RQ_SA_8BIT_IDX]); diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index ab4c85f3d6fe..8d9f2e647d9b 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -3757,6 +3757,7 @@ int ipmi_add_smi(struct module *owner, out_err_bmc_reg: ipmi_bmc_unregister(intf); out_err_started: + intf->in_shutdown = true; if (intf->handlers->shutdown) intf->handlers->shutdown(intf->send_info); out_err: |