diff options
| author | Yousef Alhouseen <alhouseenyousef@gmail.com> | 2026-06-24 21:09:19 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-17 15:49:59 +0200 |
| commit | 7bf6940d7cf41f1f0330a9bae4b7a886e18fd8e3 (patch) | |
| tree | 33912a482e701862f0d14c8d263f5cc1a7e18ba9 /drivers/misc | |
| parent | 655faba1ccf195e22a7a83146ef6015e3271233c (diff) | |
| download | linux-next-7bf6940d7cf41f1f0330a9bae4b7a886e18fd8e3.tar.gz linux-next-7bf6940d7cf41f1f0330a9bae4b7a886e18fd8e3.zip | |
misc: hpilo: validate device queue entries before use
ilo_pkt_dequeue() trusts descriptor IDs and lengths read from the shared
FIFO entry. A bad entry can select a descriptor outside the allocated
queue memory or report a packet length larger than one descriptor.
Reject entries whose descriptor index or packet length exceeds the queue
layout before deriving the packet pointer returned to read and write
paths.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260624190919.3432-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/misc')
| -rw-r--r-- | drivers/misc/hpilo.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c index ff3f03ea577e..9b54a81b43d8 100644 --- a/drivers/misc/hpilo.c +++ b/drivers/misc/hpilo.c @@ -160,11 +160,16 @@ static int ilo_pkt_dequeue(struct ilo_hwinfo *hw, struct ccb *ccb, ret = fifo_dequeue(hw, fifobar, &entry); if (ret) { + int pkt_len; + pkt_id = get_entry_id(entry); + pkt_len = get_entry_len(entry); + if (pkt_id >= NR_QENTRY || pkt_len > desc_mem_sz(1)) + return 0; if (id) *id = pkt_id; if (len) - *len = get_entry_len(entry); + *len = pkt_len; if (pkt) *pkt = (void *)(desc + desc_mem_sz(pkt_id)); } |