diff options
| author | Corey Minyard <corey@minyard.net> | 2026-04-20 20:50:09 +0300 |
|---|---|---|
| committer | Corey Minyard <corey@minyard.net> | 2026-04-21 15:29:04 +0300 |
| commit | 36920f30e78e69df01f9691c470b6f3ba8aebf98 (patch) | |
| tree | c162ae1b31114c6af9ce9a1ee36d5aa352e44579 | |
| parent | a5d1079c28a5bc6caa30ef4099ef04ed17d2c6aa (diff) | |
| download | linux-36920f30e78e69df01f9691c470b6f3ba8aebf98.tar.xz | |
ipmi: Check event message buffer response for bad data
The event message buffer response data size got checked later when
processing, but check it right after the response comes back. It
appears some BMCs may return an empty message instead of an error
when fetching events.
There are apparently some new BMCs that make this error, so we need to
compensate.
Reported-by: Matt Fleming <mfleming@cloudflare.com>
Closes: https://lore.kernel.org/lkml/20260415115930.3428942-1-matt@readmodwrite.com/
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: <stable@vger.kernel.org>
Signed-off-by: Corey Minyard <corey@minyard.net>
| -rw-r--r-- | drivers/char/ipmi/ipmi_si_intf.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c index 4a9e9de4d684..08c208cc64c5 100644 --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -630,7 +630,13 @@ static void handle_transaction_done(struct smi_info *smi_info) */ msg = smi_info->curr_msg; smi_info->curr_msg = NULL; - if (msg->rsp[2] != 0) { + /* + * It appears some BMCs, with no event data, return no + * data in the message and not a 0x80 error as the + * spec says they should. Shut down processing if + * the data is not the right length. + */ + if (msg->rsp[2] != 0 || msg->rsp_size != 19) { /* Error getting event, probably done. */ msg->done(msg); |