ibmasm: fix heap over-read in ibmasm_send_i2o_message()

The ibmasm_send_i2o_message() function uses get_dot_command_size() to
compute the byte count for memcpy_toio(), but this value is derived from
user-controlled fields in the dot_command_header (command_size: u8,
data_size: u16) and is never validated against the actual allocation size.
A root user can write a small buffer with inflated header fields, causing
memcpy_toio() to read up to ~65 KB past the end of the allocation into
adjacent kernel heap, which is then forwarded to the service processor
over MMIO.

Silently clamping the copy size is not sufficient: if the header fields
claim a larger size than the buffer, the SP receives a dot command whose
own header is inconsistent with the I2O message length, which can cause
the SP to desynchronize. Reject such commands outright by returning
failure.

Validate command_size before calling get_mfa_inbound() to avoid leaking
an I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware
frame from the controller's free pool, and returning without a
corresponding set_mfa_inbound() call would permanently exhaust it.

Additionally, clamp command_size to I2O_COMMAND_SIZE before the
memcpy_toio() so the MMIO write stays within the I2O message frame,
consistent with the clamping already performed by outgoing_message_size()
for the header field.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Tyllis Xu <LivelyCarpet87@gmail.com>
Link: https://patch.msgid.link/20260314165805.548293-1-LivelyCarpet87@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/misc/ibmasm/lowlevel.c b/drivers/misc/ibmasm/lowlevel.c
index 6922dc6c10db08d933eb5b946919fd35683627a9..5313230f36ad4d04c99ad386fb3408a9a9fe2980 100644 (file)
--- a/drivers/misc/ibmasm/lowlevel.c
+++ b/drivers/misc/ibmasm/lowlevel.c
@@ -19,17 +19,21 @@ static struct i2o_header header = I2O_HEADER_TEMPLATE;
 int ibmasm_send_i2o_message(struct service_processor *sp)
 {
        u32 mfa;
-       unsigned int command_size;
+       size_t command_size;
        struct i2o_message *message;
        struct command *command = sp->current_command;
 
+       command_size = get_dot_command_size(command->buffer);
+       if (command_size > command->buffer_size)
+               return 1;
+       if (command_size > I2O_COMMAND_SIZE)
+               command_size = I2O_COMMAND_SIZE;
+
        mfa = get_mfa_inbound(sp->base_address);
        if (!mfa)
                return 1;
 
-       command_size = get_dot_command_size(command->buffer);
-       header.message_size = outgoing_message_size(command_size);
-
+       header.message_size = outgoing_message_size((unsigned int)command_size);
        message = get_i2o_message(sp->base_address, mfa);
 
        memcpy_toio(&message->header, &header, sizeof(struct i2o_header));