From: Corey Minyard <minyard@acm.org>
To: Jakub Kicinski <kuba@kernel.org>
Cc: andrew.manley@sealingtech.com,
openipmi-developer@lists.sourceforge.net,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] ipmi: fix oob access due to uninit smi_msg type
Date: Thu, 25 Nov 2021 21:28:23 -0600 [thread overview]
Message-ID: <20211126032823.GX15676@minyard.net> (raw)
In-Reply-To: <20211125070543.7d3225af@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
On Thu, Nov 25, 2021 at 07:05:43AM -0800, Jakub Kicinski wrote:
> On Thu, 25 Nov 2021 08:21:40 -0600 Corey Minyard wrote:
> > On Wed, Nov 24, 2021 at 01:03:23PM -0800, Jakub Kicinski wrote:
> > > We're hitting OOB accesses in handle_ipmb_direct_rcv_rsp() (memcpy of
> > > size -1) after user space generates a message. Looks like the message
> > > is incorrectly assumed to be of the new IPMB type, because type is never
> > > set and message is allocated with kmalloc() not kzalloc().
> > >
> > > Fixes: 059747c245f0 ("ipmi: Add support for IPMB direct messages")
> > > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> >
> > This is correct, and in my queue. Thanks for the fix.
>
> Where is your queue, BTW? I see not T entry in MAINTAINERS and nothing
> of note in the github tree from which you send PRs.
It's at github.com:cminyard/linux-ipmi.git for-next
I hadn't pushed it up yet, I wanted to do some testing. I just pushed
it.
-corey
prev parent reply other threads:[~2021-11-26 4:18 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-24 21:03 [PATCH] ipmi: fix oob access due to uninit smi_msg type Jakub Kicinski
2021-11-25 14:21 ` Corey Minyard
2021-11-25 15:05 ` Jakub Kicinski
2021-11-26 3:28 ` Corey Minyard [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211126032823.GX15676@minyard.net \
--to=minyard@acm.org \
--cc=andrew.manley@sealingtech.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=openipmi-developer@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.