OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/drivers/char/ipmi
History
Jiri Slaby d202b0192f Char: ipmi_bt_sm, fix infinite loop 
commit a94cdd1f4d upstream.

In read_all_bytes, we do

  unsigned char i;
  ...
  bt->read_data[0] = BMC2HOST;
  bt->read_count = bt->read_data[0];
  ...
  for (i = 1; i <= bt->read_count; i++)
    bt->read_data[i] = BMC2HOST;

If bt->read_data[0] == bt->read_count == 255, we loop infinitely in the
'for' loop.  Make 'i' an 'int' instead of 'char' to get rid of the
overflow and finish the loop after 255 iterations every time.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-and-debugged-by: Rui Hui Dian <rhdian@novell.com>
Cc: Tomas Cech <tcech@suse.cz>
Cc: Corey Minyard <minyard@acm.org>
Cc: <openipmi-developer@lists.sourceforge.net>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2014-04-26 17:19:02 -07:00
..
Kconfig
…
Makefile drivers/char/ipmi/Makefile: replace the use of <module>-objs with <module>-y 2010-10-27 18:03:14 -07:00
ipmi_bt_sm.c Char: ipmi_bt_sm, fix infinite loop 2014-04-26 17:19:02 -07:00
ipmi_devintf.c ipmi: info leak in compat_ipmi_ioctl() 2013-09-05 08:34:31 -07:00
ipmi_kcs_sm.c ipmi: use USEC_PER_SEC instead of 1000000 for more meaningful 2014-01-25 15:31:58 -08:00
ipmi_msghandler.c ipmi: Initialize locals to avoid warning 2013-09-05 08:34:31 -07:00
ipmi_poweroff.c char: Convert use of typedef ctl_table to struct ctl_table 2013-06-17 16:43:08 -07:00
ipmi_si_intf.c ipmi: Add missing rv in ipmi_parisc_probe() 2014-01-30 10:02:54 -08:00
ipmi_si_sm.h IPMI: Style fixes in the system interface code 2008-04-29 08:06:15 -07:00
ipmi_smic_sm.c ipmi: use USEC_PER_SEC instead of 1000000 for more meaningful 2014-01-25 15:31:58 -08:00
ipmi_watchdog.c char/ipmi: remove local ioctl defines replaced by generic ones 2012-07-23 12:48:04 +02:00