Commit d2c12f56 authored by Corey Minyard's avatar Corey Minyard
Browse files

ipmi: fix IPMI_SMI_MSG_TYPE_IPMB_DIRECT response length checking 



A couple of issues:

The tested data sizes are wrong; during the design that changed and this
got missed.

The formatting of the reponse couldn't use the normal one, it has to be
an IPMB formatted response.

Reported-by: default avatarJakub Kicinski <kuba@kernel.org>
Fixes: 059747c2 ("ipmi: Add support for IPMB direct messages")
Signed-off-by: default avatarCorey Minyard <cminyard@mvista.com>
parent c33fdfba

drivers/char/ipmi/ipmi_msghandler.c

+15 −4
Original line number Original line Diff line number Diff line
@@ -4457,13 +4457,24 @@ static int handle_one_recv_msg(struct ipmi_smi *intf, 
		msg->rsp[2] = IPMI_ERR_UNSPECIFIED;

		msg->rsp[2] = IPMI_ERR_UNSPECIFIED;

		msg->rsp_size = 3;

		msg->rsp_size = 3;

	} else if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) {

	} else if (msg->type == IPMI_SMI_MSG_TYPE_IPMB_DIRECT) {

		/* commands must have at least 3 bytes, responses 4. */

		/* commands must have at least 4 bytes, responses 5. */

		if (is_cmd && (msg->rsp_size < 3)) {

		if (is_cmd && (msg->rsp_size < 4)) {

			ipmi_inc_stat(intf, invalid_commands);

			ipmi_inc_stat(intf, invalid_commands);

			goto out;

			goto out;

		}

		}

		if (!is_cmd && (msg->rsp_size < 4))

		if (!is_cmd && (msg->rsp_size < 5)) {

			goto return_unspecified;

			ipmi_inc_stat(intf, invalid_ipmb_responses);

			/* Construct a valid error response. */

			msg->rsp[0] = msg->data[0] & 0xfc; /* NetFN */

			msg->rsp[0] |= (1 << 2); /* Make it a response */

			msg->rsp[0] |= msg->data[2] & 3; /* rqLUN */

			msg->rsp[1] = msg->data[1]; /* Addr */

			msg->rsp[2] = msg->data[2] & 0xfc; /* rqSeq */

			msg->rsp[2] |= msg->data[0] & 0x3; /* rsLUN */

			msg->rsp[3] = msg->data[3]; /* Cmd */

			msg->rsp[4] = IPMI_ERR_UNSPECIFIED;

			msg->rsp_size = 5;

		}

	} else if ((msg->data_size >= 2)

	} else if ((msg->data_size >= 2)

	    && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))

	    && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))

	    && (msg->data[1] == IPMI_SEND_MSG_CMD)

	    && (msg->data[1] == IPMI_SEND_MSG_CMD)