Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-linus-6.11-1' of https://github.com/cminyard/linux-ipmi
Pull IPMI updates from Corey Minyard:
"Some cleanups for device changes coming, and some range checks on data
coming from a host to a BMC"
* tag 'for-linus-6.11-1' of https://github.com/cminyard/linux-ipmi:
ipmi: Drop explicit initialization of struct i2c_device_id::driver_data to 0
ipmi: ssif_bmc: prevent integer overflow on 32bit systems
+11
-9
+2
-2
drivers/char/ipmi/ipmb_dev_int.c
+2
-2
drivers/char/ipmi/ipmb_dev_int.c
+2
-2
drivers/char/ipmi/ipmi_ipmb.c
+2
-2
drivers/char/ipmi/ipmi_ipmb.c
+1
-1
drivers/char/ipmi/ipmi_ssif.c
+1
-1
drivers/char/ipmi/ipmi_ssif.c
+6
-4
drivers/char/ipmi/ssif_bmc.c
+6
-4
drivers/char/ipmi/ssif_bmc.c
···
177
177
unsigned long flags;
178
178
ssize_t ret;
179
179
180
-
if (count > sizeof(struct ipmi_ssif_msg))
180
+
if (count < sizeof(msg.len) ||
181
+
count > sizeof(struct ipmi_ssif_msg))
181
182
return -EINVAL;
182
183
183
184
if (copy_from_user(&msg, buf, count))
184
185
return -EFAULT;
185
186
186
-
if (!msg.len || count < sizeof_field(struct ipmi_ssif_msg, len) + msg.len)
187
+
if (!msg.len || msg.len > IPMI_SSIF_PAYLOAD_MAX ||
188
+
count < sizeof_field(struct ipmi_ssif_msg, len) + msg.len)
187
189
return -EINVAL;
188
190
189
191
spin_lock_irqsave(&ssif_bmc->lock, flags);
···
852
850
MODULE_DEVICE_TABLE(of, ssif_bmc_match);
853
851
854
852
static const struct i2c_device_id ssif_bmc_id[] = {
855
-
{ DEVICE_NAME, 0 },
856
-
{ },
853
+
{ DEVICE_NAME },
854
+
{ }
857
855
};
858
856
MODULE_DEVICE_TABLE(i2c, ssif_bmc_id);
859
857