mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 09:36:22 +02:00
9aad71144f
The ibmasm_send_i2o_message() function uses get_dot_command_size() to
compute the byte count for memcpy_toio(), but this value is derived from
user-controlled fields in the dot_command_header (command_size: u8,
data_size: u16) and is never validated against the actual allocation size.
A root user can write a small buffer with inflated header fields, causing
memcpy_toio() to read up to ~65 KB past the end of the allocation into
adjacent kernel heap, which is then forwarded to the service processor
over MMIO.
Silently clamping the copy size is not sufficient: if the header fields
claim a larger size than the buffer, the SP receives a dot command whose
own header is inconsistent with the I2O message length, which can cause
the SP to desynchronize. Reject such commands outright by returning
failure.
Validate command_size before calling get_mfa_inbound() to avoid leaking
an I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware
frame from the controller's free pool, and returning without a
corresponding set_mfa_inbound() call would permanently exhaust it.
Additionally, clamp command_size to I2O_COMMAND_SIZE before the
memcpy_toio() so the MMIO write stays within the I2O message frame,
consistent with the clamping already performed by outgoing_message_size()
for the header field.
Fixes:
|
||
|---|---|---|
| .. | ||
| command.c | ||
| dot_command.c | ||
| dot_command.h | ||
| event.c | ||
| heartbeat.c | ||
| i2o.h | ||
| ibmasm.h | ||
| ibmasmfs.c | ||
| lowlevel.c | ||
| lowlevel.h | ||
| Makefile | ||
| module.c | ||
| r_heartbeat.c | ||
| remote.c | ||
| remote.h | ||
| uart.c | ||