From nobody Tue Apr 7 08:08:05 2026 Received: from mail-qv1-f46.google.com (mail-qv1-f46.google.com [209.85.219.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A0BF319848 for ; Sat, 14 Mar 2026 16:54:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773507264; cv=none; b=AOFr1Olga/Hg7s4BiS8ne3+pGtIVt2W8xcAi1BN5KvxJJoSqPdNnHPSfgoFqdvrlVJO/hGPGhE6O6/mTdfmMVYTVcGlSKnhp+wCmDPG2T3YriGXOptaThlGjvZG3Fwu6kuQZMfqPZ4pLQ7605TnflRVCG7GwADi2HgD2NY1IwIQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773507264; c=relaxed/simple; bh=Jij9gi3TsnS7xUAJHX5L0HW3kLeYqNjfpTF6uWaPqV0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GXHNZe9KEh6PsX4h4oyp5FhzrA5DgM4HgfQTQWnAOn3hNDyywVhgJqYQtVgZtwv+KPaVN7G0rHzzx/2vV3Ms/QfijestZHgRtPdpO5XablY8R3Ou8zJ2JLHxEBfkEy5zh7WFOZXVO6OXCvxKj2a7sJS24oNLIPOYvLYLgvxvScs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PPrP7LnS; arc=none smtp.client-ip=209.85.219.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PPrP7LnS" Received: by mail-qv1-f46.google.com with SMTP id 6a1803df08f44-89a14be4733so40382766d6.2 for ; Sat, 14 Mar 2026 09:54:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773507260; x=1774112060; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=cPyKAj/9uBDc/GZMXJxB4GAuk/lnBgwa2DYDtcJI+Qs=; b=PPrP7LnSWGe3DEd/JsWPEIPXmKmYN8fls0kUZwcCnMiMp3f+fUj+kpJuHHJBwaxCL+ lIEMu5FTCD/Z41wL7UnBo1h8AxM/leCvC8A2w31WdebNsZhBvIQ2aTOoN189GEoBfv2y XRmL8jSzY6BhFA9cZ2HLaJV869+DqruLZiyVXW1FdvwAe2WIzOp39ZWZ4T7AAFBYkuBX iDohF8ycvb4mYF7FDLzt/ysal+BuYc3iiF1fEM+KgE2ps6RczOFKt3deOVMo0Cm3VstH wz3BhVykjCuu0BSy9DDMRuvbSTYzWDVpdoT867KWkbXCf+XCUHivI1RyC5HdJPN8O73f /bxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773507260; x=1774112060; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=cPyKAj/9uBDc/GZMXJxB4GAuk/lnBgwa2DYDtcJI+Qs=; b=CO4jbuxAuWY/OTsi8mrIBxpwePtrhxKgUgWi4BywT4G/ZjgwucpagA6PhfuJquvVHt FIWFcUXYMH6L8dQaSs4sKxaAD78wRXCvRJ9Ak+dDT/LakaLMBrdr+iHRhY6oPBxWCBpz tk5OzluB58yNe3Qhl06jcxDTwwyP8WI6BjjgNZRY1S8iHfXscFcOhg52ef/kXM+fo0M6 TLcfk+nzQvvlUwsMD/NcXTDGfe9/hpqLVdLb/ilJe9K6Wo4H8tlFRMcDQ/FTExd44mcX 5Ff881v23TLqysOqDqMYQ8jxNbmBzIVjGDtzUlMHGHbe9s8E85GV1uCfD/VosUlZKGIx ODsA== X-Forwarded-Encrypted: i=1; AJvYcCVat2eugGBBVTWH8X1/uV2YeBcaWaDFoG+eLYxPvXP2OOyNTA0fPnO8o9058buipQ1Nx9j1do6OL+9C4VU=@vger.kernel.org X-Gm-Message-State: AOJu0YwwNHYG1MgLFG9XkLwrsA6KcyL5NVCywXrU1ePLvkJzXdwWGdgg 8YOx+2Q8u4fJx0eFpbmuaJGNpVin9xsPiFG8BohwdZbiGFNtMgbaIgEuXTV/EJt2 X-Gm-Gg: ATEYQzxvsypIACnW0BJFah0LxBz57S6mvMpGPw6Afjg8Az92PphdtekkY7VZOGE4q8V RCNlgILxu9EHM6cJjZ+h7dSGed1tfi76Cr9Xdva1H5XnJLY1WbOvxeNOZI8fjNHNH23xMDOWBqs PYmqf826K66N5nSo4aJEotkyllfQ6oZw0N/c5eR285k75OqFixf/u2LHg3RRR9r8So+PKxHWBWs hz8GakXGakUHeP9i0BMQGDn2vzjnW4AvIxjEIHELP8yQ6Jh4JFlbaTKZyWvrly4v4fJe1kf0nx4 O+yGEYenM4QdDt8OhREOiqZOBcJT98UaKijdLiLgxkz5x+8xG4nA7u0xZWAXDyio4C1AfpmslOV k3GgaiPp+7JroUdUXQ+e+buHYjpGxtf3jd00NT4JykRqIxqGHcg7m5si2r8HjwsjYNQnGhRBjWY b3qg1Pc5Fwxos9Is8bmkSI0dkviZ51sV6OqhQ75UOx2OjOpgh9oc0I+zcPdX9cOqu2HQDMtKC/q ALT X-Received: by 2002:a05:6214:529d:b0:89a:f10:996e with SMTP id 6a1803df08f44-89a81cb9887mr107045666d6.6.1773507260019; Sat, 14 Mar 2026 09:54:20 -0700 (PDT) Received: from CS-396-Lab-Machine.. (c-24-12-10-127.hsd1.il.comcast.net. [24.12.10.127]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-89a65cd7f49sm83527896d6.34.2026.03.14.09.54.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 14 Mar 2026 09:54:19 -0700 (PDT) From: Tyllis Xu X-Google-Original-From: Tyllis Xu To: gregkh@linuxfoundation.org, arnd@arndb.de Cc: kees@kernel.org, linux-kernel@vger.kernel.org, ychen@northwestern.edu, Tyllis Xu , Yuhao Jiang , stable@vger.kernel.org Subject: [PATCH] ibmasm: fix OOB reads in command_file_write due to missing size checks Date: Sat, 14 Mar 2026 11:53:54 -0500 Message-ID: <20260314165355.548119-1-LivelyCarpet87@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The command_file_write() handler allocates a kernel buffer of exactly count bytes and copies user data into it, but does not validate the buffer against the dot command protocol before passing it to get_dot_command_size() and get_dot_command_timeout(). Since both the allocation size (count) and the header fields (command_size, data_size) are independently user-controlled, an attacker can cause get_dot_command_size() to return a value exceeding the allocation, triggering OOB reads in get_dot_command_timeout() and an out-of-bounds memcpy_toio() that leaks kernel heap memory to the service processor. Fix with two guards: reject writes smaller than sizeof(struct dot_command_header) before allocation, then after copying user data reject commands where the buffer is smaller than the total size declared by the header (sizeof(header) + command_size + data_size). This ensures all subsequent header and payload field accesses stay within the buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Tyllis Xu --- drivers/misc/ibmasm/ibmasmfs.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/misc/ibmasm/ibmasmfs.c b/drivers/misc/ibmasm/ibmasmfs.c index f68a8957b98f..dfdfa9ba4747 100644 --- a/drivers/misc/ibmasm/ibmasmfs.c +++ b/drivers/misc/ibmasm/ibmasmfs.c @@ -303,6 +303,8 @@ static ssize_t command_file_write(struct file *file, co= nst char __user *ubuff, s return -EINVAL; if (count =3D=3D 0 || count > IBMASM_CMD_MAX_BUFFER_SIZE) return 0; + if (count < sizeof(struct dot_command_header)) + return -EINVAL; if (*offset !=3D 0) return 0; =20 @@ -319,6 +321,11 @@ static ssize_t command_file_write(struct file *file, c= onst char __user *ubuff, s return -EFAULT; } =20 + if (count < get_dot_command_size(cmd->buffer)) { + command_put(cmd); + return -EINVAL; + } + spin_lock_irqsave(&command_data->sp->lock, flags); if (command_data->command) { spin_unlock_irqrestore(&command_data->sp->lock, flags); --=20 2.43.0