mirror of
https://github.com/torvalds/linux.git
synced 2026-05-12 16:18:45 +02:00
9aad71144f
The ibmasm_send_i2o_message() function uses get_dot_command_size() to
compute the byte count for memcpy_toio(), but this value is derived from
user-controlled fields in the dot_command_header (command_size: u8,
data_size: u16) and is never validated against the actual allocation size.
A root user can write a small buffer with inflated header fields, causing
memcpy_toio() to read up to ~65 KB past the end of the allocation into
adjacent kernel heap, which is then forwarded to the service processor
over MMIO.
Silently clamping the copy size is not sufficient: if the header fields
claim a larger size than the buffer, the SP receives a dot command whose
own header is inconsistent with the I2O message length, which can cause
the SP to desynchronize. Reject such commands outright by returning
failure.
Validate command_size before calling get_mfa_inbound() to avoid leaking
an I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware
frame from the controller's free pool, and returning without a
corresponding set_mfa_inbound() call would permanently exhaust it.
Additionally, clamp command_size to I2O_COMMAND_SIZE before the
memcpy_toio() so the MMIO write stays within the I2O message frame,
consistent with the clamping already performed by outgoing_message_size()
for the header field.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Tyllis Xu <LivelyCarpet87@gmail.com>
Link: https://patch.msgid.link/20260314165805.548293-1-LivelyCarpet87@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
76 lines
1.8 KiB
C
76 lines
1.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* IBM ASM Service Processor Device Driver
|
|
*
|
|
* Copyright (C) IBM Corporation, 2004
|
|
*
|
|
* Author: Max Asböck <amax@us.ibm.com>
|
|
*/
|
|
|
|
#include "ibmasm.h"
|
|
#include "lowlevel.h"
|
|
#include "i2o.h"
|
|
#include "dot_command.h"
|
|
#include "remote.h"
|
|
|
|
static struct i2o_header header = I2O_HEADER_TEMPLATE;
|
|
|
|
|
|
int ibmasm_send_i2o_message(struct service_processor *sp)
|
|
{
|
|
u32 mfa;
|
|
size_t command_size;
|
|
struct i2o_message *message;
|
|
struct command *command = sp->current_command;
|
|
|
|
command_size = get_dot_command_size(command->buffer);
|
|
if (command_size > command->buffer_size)
|
|
return 1;
|
|
if (command_size > I2O_COMMAND_SIZE)
|
|
command_size = I2O_COMMAND_SIZE;
|
|
|
|
mfa = get_mfa_inbound(sp->base_address);
|
|
if (!mfa)
|
|
return 1;
|
|
|
|
header.message_size = outgoing_message_size((unsigned int)command_size);
|
|
message = get_i2o_message(sp->base_address, mfa);
|
|
|
|
memcpy_toio(&message->header, &header, sizeof(struct i2o_header));
|
|
memcpy_toio(&message->data, command->buffer, command_size);
|
|
|
|
set_mfa_inbound(sp->base_address, mfa);
|
|
|
|
return 0;
|
|
}
|
|
|
|
irqreturn_t ibmasm_interrupt_handler(int irq, void * dev_id)
|
|
{
|
|
u32 mfa;
|
|
struct service_processor *sp = (struct service_processor *)dev_id;
|
|
void __iomem *base_address = sp->base_address;
|
|
char tsbuf[32];
|
|
|
|
if (!sp_interrupt_pending(base_address))
|
|
return IRQ_NONE;
|
|
|
|
dbg("respond to interrupt at %s\n", get_timestamp(tsbuf));
|
|
|
|
if (mouse_interrupt_pending(sp)) {
|
|
ibmasm_handle_mouse_interrupt(sp);
|
|
clear_mouse_interrupt(sp);
|
|
}
|
|
|
|
mfa = get_mfa_outbound(base_address);
|
|
if (valid_mfa(mfa)) {
|
|
struct i2o_message *msg = get_i2o_message(base_address, mfa);
|
|
ibmasm_receive_message(sp, &msg->data, incoming_data_size(msg));
|
|
} else
|
|
dbg("didn't get a valid MFA\n");
|
|
|
|
set_mfa_outbound(base_address, mfa);
|
|
dbg("finished interrupt at %s\n", get_timestamp(tsbuf));
|
|
|
|
return IRQ_HANDLED;
|
|
}
|