diff options
| author | Yousef Alhouseen <alhouseenyousef@gmail.com> | 2026-06-24 19:53:53 +0200 |
|---|---|---|
| committer | Corey Minyard <corey@minyard.net> | 2026-07-02 06:46:25 -0500 |
| commit | 53637506884dbd5c91a89b1a3547d99d80f8ed2c (patch) | |
| tree | 33c616260fa4ed86b8e601535d77f6594ed5cb64 /include | |
| parent | 4edcdefd4083ae04b1a5656f4be6cd83ae919ef4 (diff) | |
| download | linux-next-53637506884dbd5c91a89b1a3547d99d80f8ed2c.tar.gz linux-next-53637506884dbd5c91a89b1a3547d99d80f8ed2c.zip | |
ipmi: ipmb: validate write message length
ipmb_write() read message fields before validating the length byte.
A zero or short write can read uninitialized stack bytes.
A length smaller than the SMBus header underflows the block write length.
Require a non-empty buffer and the minimum IPMB request length.
Also require the length byte plus payload before parsing the message.
Fixes: 51bd6f291583 ("Add support for IPMB driver")
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Message-ID: <20260624175353.8592-1-alhouseenyousef@gmail.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions