From nobody Wed Jun 17 01:51:33 2026 Received: from mail-oa1-f49.google.com (mail-oa1-f49.google.com [209.85.160.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E28423D0901 for ; Tue, 21 Apr 2026 13:25:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776777954; cv=none; b=WBhngzvxXqG9BxnZHW3a6pWsMdx6J4DP+iIZJnFEBSVsRelmjUbkroe0W6WYw/qGwho1colYU0CDr3w5YrTonIxgR27e/0OrWfochu7MTa+D9kPpLiKzIJbTJ5SnlErKrLLCRBH1DSSNE5dJu6tUb4X81vgpYrzr7S9OVYjLYd8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776777954; c=relaxed/simple; bh=79Lh6Hza3vFj/wwIyqRM4tXF0uZ0ixWXF5FGZekCV/Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r66PkeRzkwXi94+kM4DVAOa3AgZJ0zVX2FAzvRj2TGdA5zoF6L0UP3LfDAJpeGxs/9vjxntgDbLbexi0DzkhQTzXZjizKTjTd1dBbmIl0JbPo0jmqkL7vm5B0xcrDvD/0qlDDVKp2vrfEG/azAmla6iTh1rmXUJeSGW2OEjU/r8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=minyard.net; spf=pass smtp.mailfrom=minyard.net; dkim=pass (2048-bit key) header.d=minyard.net header.i=@minyard.net header.b=XDC0u0EP; arc=none smtp.client-ip=209.85.160.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=minyard.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=minyard.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=minyard.net header.i=@minyard.net header.b="XDC0u0EP" Received: by mail-oa1-f49.google.com with SMTP id 586e51a60fabf-42c08cbae4cso1354996fac.2 for ; Tue, 21 Apr 2026 06:25:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=minyard.net; s=google; t=1776777952; x=1777382752; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Dn8v2QAFkXlBjIgtscUI2wvGE8UVKuLcXTXCNPkIjzQ=; b=XDC0u0EPIV5W0vVerdLRRYIjQqCkyqGbzZlXNjQ1vh/TJ/K+5TjFH7xoc0RI5CNFaX nVGBuLzMnVzICsNesSq2GZarYHcfVp4F7WbpSljZkkKBWbQr0iBDwr9YuLp5Mgj4X+e2 RTsqAYctnrza1V+yQ8SSJXu6CpKinMY6xGoPaM0s8vzxLS4JVpSnSAHjugU77Rvo7/4B 08kuVqf01Kra95/KV6jEj3ffEPWaXAIWx2MgEX7VzLTjNqHGnNT3v/9LUBuLwtHz1Nue xxK+bIazR8REsStg4FlTjpFZkRJIX/Qe2lUQt7gI9kkMjkDpaCtPB4qxAH5fp4CjLRvZ G63Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776777952; x=1777382752; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Dn8v2QAFkXlBjIgtscUI2wvGE8UVKuLcXTXCNPkIjzQ=; b=cUGe67ECecLSGo3f/amO5bOTzInwV8aq6c3xzLEEQtLow1VTg03hwrneXUiRiohn1j ugvn/XXgZiD198NVsZ9ATLnjumYdoPXV5cVKjNVNPYZkniWU35/5lODUlGe/oRM+QkY5 wjrZRbU4O6ymQYIiTTtsrFq/FAmy3DeNxdGYIM+B89AEUWWJtDZMCldXjSlwMBQv2rPj 860QNrWOcF30WP5F2a3LAUywp6oTPLMk8sVnd31WPMqg3o3JFelZ/bMurr+z0vhSpJRh 0jm8IzPPGd/1RWFcoygzxKDBAshWdaZoPbWqnsS8OkSLEf8ebzglHK+D2zi2TcduXAuM MjLw== X-Forwarded-Encrypted: i=1; AFNElJ8qg1RTwYRFB5VWpNRY3ZM3E4v/QrU81Nn2k0FDqk7Y/8b35fgg3Dbrl93VRGkVuIcTerKJphNMt/kN+SA=@vger.kernel.org X-Gm-Message-State: AOJu0YxXZPthh7CFM0OfWnRP1KZtzIYv4rk16BsP2YErlfJVa2FG2X7t B11qZQGmMgSoFXUEAQKb1M7226zMVwDKEQXOgXCezC9zM0tdJpS8cJgdTLc76isoVBk= X-Gm-Gg: AeBDietnzimhacRSGtX/ATGn1PWZ4ECVxIwrXJXdQVIRlBu48zw3zXyXlixdwJbGHX9 Tl32t21x3WII/TR6cjnXMkGfrTCJZG+TENLtzvsoXTvpXqPf4/116P1qaPlUVrpKl1P2WIv/G9l lYGr1MHeDYLUNirydOTVxLOWCmM5O3AZxHx3UmZkol7/InDPvZhyIPLEKWcJfPIky5wjhuJ0sjE h/zZa85+jkr3SXgttHsX2vuHBgNTQM1fpNZ683O2lTf62yEOgrg5XymFGoecA0yGloHGnlw2tcE duLqIMvGeCja5pUMeDRj2GHsKMJynLuSBUY/DS1QiGXypt5z4oNqyVezI1Pcf1fBA3GeLytORxA zErFWeYeTGIry6UpXSjCQV3uLUyGLpHfxNJeoP/6ljtnJ29GHJN4Tz5xZhvIpnCoBDUxd898Qp/ nVThrPS2eM/t1AxIgdNPswN1GazZJqazY7l4IydRgNP/AcOv0cEYXFwJvwUt7FKc21QOCSWqbul Jjvr3YblzSz7ANa X-Received: by 2002:a05:6870:2c91:b0:409:9a0b:b733 with SMTP id 586e51a60fabf-42abf29cc2fmr10719696fac.10.1776777951714; Tue, 21 Apr 2026 06:25:51 -0700 (PDT) Received: from localhost ([2001:470:b8f6:1b:376f:c507:59cb:4749]) by smtp.gmail.com with UTF8SMTPSA id 586e51a60fabf-42fae7ee3a5sm952278fac.7.2026.04.21.06.25.50 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 21 Apr 2026 06:25:51 -0700 (PDT) From: Corey Minyard To: Matt Fleming Cc: openipmi-developer@lists.sourceforge.net, Tony Camuso , linux-kernel@vger.kernel.org, kernel-team@cloudflare.com, Corey Minyard , stable@vger.kernel.org Subject: [PATCH 1/2] ipmi: Check event message buffer response for bad data Date: Tue, 21 Apr 2026 07:42:43 -0500 Message-ID: <20260421132544.2666174-2-corey@minyard.net> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260421132544.2666174-1-corey@minyard.net> References: <20260421132544.2666174-1-corey@minyard.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The event message buffer response data size got checked later when processing, but check it right after the response comes back. It appears some BMCs may return an empty message instead of an error when fetching events. There are apparently some new BMCs that make this error, so we need to compensate. Reported-by: Matt Fleming Closes: https://lore.kernel.org/lkml/20260415115930.3428942-1-matt@readmodw= rite.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: Signed-off-by: Corey Minyard --- drivers/char/ipmi/ipmi_si_intf.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_i= ntf.c index 4a9e9de4d684..08c208cc64c5 100644 --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -630,7 +630,13 @@ static void handle_transaction_done(struct smi_info *s= mi_info) */ msg =3D smi_info->curr_msg; smi_info->curr_msg =3D NULL; - if (msg->rsp[2] !=3D 0) { + /* + * It appears some BMCs, with no event data, return no + * data in the message and not a 0x80 error as the + * spec says they should. Shut down processing if + * the data is not the right length. + */ + if (msg->rsp[2] !=3D 0 || msg->rsp_size !=3D 19) { /* Error getting event, probably done. */ msg->done(msg); =20 --=20 2.43.0 From nobody Wed Jun 17 01:51:33 2026 Received: from mail-ot1-f42.google.com (mail-ot1-f42.google.com [209.85.210.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8227040855 for ; Tue, 21 Apr 2026 13:25:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776777957; cv=none; b=f9B5Sqd1NNpFT7BN//UX8ZTUflLqhSyt8b39UEVcIfEsZb+EknpnO2nMVbQ7srYoV7C6x9rTFfQM5utIsPgbmIB9zBu7HGRShQhVM5HKh8g4xcajrFZ1hYbtyrYtSTZArwPyv+IJyQjmOylDY6qKqZ5FXtlOcS3jD4BpZFwHl9A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776777957; c=relaxed/simple; bh=eQD26XzpLoSwe75J+uS061hjUdY3yx0RdEz2pW3zXbE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jY39yuH0T9M/kB0TWe84z9E7gQeq2mVKPDl5fzQJwHx4hb5BKVFec5Ip1cG//rmhO+F81mjFkWJvzLy/qD6HF+iHVn/yq3JHuGzO/xWgfG/NE4fSGEybhCesBNyJZJIQ2vMHx1Igqom9yc/VTFL8coDvZihZ5ELtbSDD+EVfD+o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=minyard.net; spf=pass smtp.mailfrom=minyard.net; dkim=pass (2048-bit key) header.d=minyard.net header.i=@minyard.net header.b=Sj8RV/tE; arc=none smtp.client-ip=209.85.210.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=minyard.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=minyard.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=minyard.net header.i=@minyard.net header.b="Sj8RV/tE" Received: by mail-ot1-f42.google.com with SMTP id 46e09a7af769-7d4c12ff3d5so3810602a34.2 for ; Tue, 21 Apr 2026 06:25:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=minyard.net; s=google; t=1776777953; x=1777382753; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=v32D4Ihg8m4TlUZ9/Ylii2aIdih85JiynNfKmLVnqEM=; b=Sj8RV/tEMQqWtNv1z5lpZ7j5b6pJoLAnZof/vkHsPmnjJhlHCZZsDmO0csDOhFJVmk 13p5yCJU+0gdv5XfTW7oYUeiGndaJGNR0ZJYrfnOV7lz7/EqicucqZAyCZjmo+e+3PS4 fwvogSCheEZ2nelg1s5UBSrxpSF8ZfgqbvUfPsUvyCY6B8XdzHsoT3J2RljZeqRhk6oZ t0CzruYnYuycQmY1KBX32KokBu26uYQaYNjU2cZ2QYduvzlmIA9sIZemKAf3p+vLX4OR fd1guFaAZt2wZH9kBJyuKKL5J1OVn0RrJDaE/XnggjEtcQ/qBfcg/Bka1NDG/TclFIbC y57w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776777953; x=1777382753; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=v32D4Ihg8m4TlUZ9/Ylii2aIdih85JiynNfKmLVnqEM=; b=Aa5iedUT2psF7kz730mLoSppXUU1l2/XAkDSo+Prx3XKap6rQXymfWpUUfWpdXmOM/ kYs5f5bGLUK/7Z+a8GMkpew5U5wHp1v2UXKJbkxBzo6dstl1FXxhgyStmjR7YBFH2QZ6 cHoo+GVHnFJn1j7Xy1svknljIY93oslnhA/HP99UTTOReTBd9xijQgaCsl4SBukNJFko sJLG6zFOncsIzll5KjszwraobgOkaaZDkaVn154bMJlp6zWGg78l0w+fjFLb2b9qtbhp rafSHTNMhF76K7+oZYN/qGcRe1c9yQeQmSmUt2v0Q4D5nKaSCdTyP2W4eGuhQyu5hePm pvZw== X-Forwarded-Encrypted: i=1; AFNElJ8/zGGFb+cEqSFe3ike+EHluxqxqZ5Mf6gr61w/BPQvDGu0Vv8UCZTviF0PnpVK1nmwdM7rc4dz4KDQGJo=@vger.kernel.org X-Gm-Message-State: AOJu0YxwukM+jxSKUvbMK3156YiFpuH0tnbstTIq8jjtq6u5/5xDeFiR yWVaqGk0zvWZ03O1LE8IZJiUoP0vhdeyQ3XRSXsEH9I95aoai+wboMCjWPGrOhF0hm0= X-Gm-Gg: AeBDievZQrAOdFCs6/ycM3s34nWMmwU3fsaUsDCVrUnE/H6novYosqDRx2qocm2Sr6E 77tHrv1ssAXqsgAPAEI+Ls+MXBY9GfTdVD9Z8RMaSP7/+BFjNlHfjJVRknz2qcomuvFvpwKqTpy ZJW0PIJKVHnWacf/P6YttBzwQoAKRdLO8lDumcTYD4ueXzLYA7rskoiIyeA7VpNN9NArWL73TBW YLTcqCe76scyjV9B9iI1DmeoEMSL5IsA+hbpcjTStvdl1uY3eqrU9rFjPpRy48dn48jT4qoaQwP 8HlcUynaFKC91faaQ1UxZo9We22Rls9Mibq+ewM1Y7wxuM+lfAej403NZgWZbABDg58rPI6CyuM 6QOG8JwN6saQaJP4wOng61VAqMzxi31lVpPmpZCGTaKzyBoe008/kZ5A02fUdIOxEDT+vmOP+wm EzC3ZvVOrZ4cDTbuM6Rp5n2mRURek/tuARxK9/XT2jnBWw4aYZhGbx042bYpmbHu1JGC9fsYeha BppY/AzAIrG6SBF X-Received: by 2002:a05:6830:82ae:b0:7dc:cbaa:d730 with SMTP id 46e09a7af769-7dccbaaf733mr4263878a34.8.1776777953394; Tue, 21 Apr 2026 06:25:53 -0700 (PDT) Received: from localhost ([2001:470:b8f6:1b:376f:c507:59cb:4749]) by smtp.gmail.com with UTF8SMTPSA id 46e09a7af769-7dcd9a0847esm1641699a34.17.2026.04.21.06.25.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 21 Apr 2026 06:25:52 -0700 (PDT) From: Corey Minyard To: Matt Fleming Cc: openipmi-developer@lists.sourceforge.net, Tony Camuso , linux-kernel@vger.kernel.org, kernel-team@cloudflare.com, Corey Minyard , stable@vger.kernel.org Subject: [PATCH 2/2] ipmi: Add limits to event and receive message requests Date: Tue, 21 Apr 2026 07:42:44 -0500 Message-ID: <20260421132544.2666174-3-corey@minyard.net> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260421132544.2666174-1-corey@minyard.net> References: <20260421132544.2666174-1-corey@minyard.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The driver would just fetch events and receive messages until the BMC said it was done. To avoid issues with BMCs that never say they are done, add a limit of 10 fetches at a time. This is a more general fix than the previous fix for the specific bad BMC, but should fix the more general issue of a BMC that won't stop saying it has data. This has been there from the beginning of the driver. Reported-by: Matt Fleming Closes: https://lore.kernel.org/lkml/20260415115930.3428942-1-matt@readmodw= rite.com/ Fixes: <1da177e4c3f4> ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard --- drivers/char/ipmi/ipmi_si_intf.c | 15 +++++++++++++++ drivers/char/ipmi/ipmi_ssif.c | 15 +++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_i= ntf.c index 08c208cc64c5..a705aae29867 100644 --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -168,6 +168,9 @@ struct smi_info { OEM2_DATA_AVAIL) unsigned char msg_flags; =20 + /* When requesting events and messages, don't do it forever. */ + unsigned int num_requests_in_a_row; + /* Does the BMC have an event buffer? */ bool has_event_buffer; =20 @@ -410,6 +413,7 @@ static void start_getting_msg_queue(struct smi_info *sm= i_info) =20 start_new_msg(smi_info, smi_info->curr_msg->data, smi_info->curr_msg->data_size); + smi_info->num_requests_in_a_row =3D 0; smi_info->si_state =3D SI_GETTING_MESSAGES; } =20 @@ -421,6 +425,7 @@ static void start_getting_events(struct smi_info *smi_i= nfo) =20 start_new_msg(smi_info, smi_info->curr_msg->data, smi_info->curr_msg->data_size); + smi_info->num_requests_in_a_row =3D 0; smi_info->si_state =3D SI_GETTING_EVENTS; } =20 @@ -646,6 +651,11 @@ static void handle_transaction_done(struct smi_info *s= mi_info) } else { smi_inc_stat(smi_info, events); =20 + smi_info->num_requests_in_a_row++; + if (smi_info->num_requests_in_a_row > 10) + /* Stop if we do this too many times. */ + smi_info->msg_flags &=3D ~EVENT_MSG_BUFFER_FULL; + /* * Do this before we deliver the message * because delivering the message releases the @@ -684,6 +694,11 @@ static void handle_transaction_done(struct smi_info *s= mi_info) } else { smi_inc_stat(smi_info, incoming_messages); =20 + smi_info->num_requests_in_a_row++; + if (smi_info->num_requests_in_a_row > 10) + /* Stop if we do this too many times. */ + smi_info->msg_flags &=3D ~RECEIVE_MSG_AVAIL; + /* * Do this before we deliver the message * because delivering the message releases the diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c index b49500a1bd36..547447f304ba 100644 --- a/drivers/char/ipmi/ipmi_ssif.c +++ b/drivers/char/ipmi/ipmi_ssif.c @@ -225,6 +225,9 @@ struct ssif_info { bool has_event_buffer; bool supports_alert; =20 + /* When requesting events and messages, don't do it forever. */ + unsigned int num_requests_in_a_row; + /* * Used to tell what we should do with alerts. If we are * waiting on a response, read the data immediately. @@ -413,6 +416,7 @@ static void start_event_fetch(struct ssif_info *ssif_in= fo, unsigned long *flags) } =20 ssif_info->curr_msg =3D msg; + ssif_info->num_requests_in_a_row =3D 0; ssif_info->ssif_state =3D SSIF_GETTING_EVENTS; ipmi_ssif_unlock_cond(ssif_info, flags); =20 @@ -436,6 +440,7 @@ static void start_recv_msg_fetch(struct ssif_info *ssif= _info, } =20 ssif_info->curr_msg =3D msg; + ssif_info->num_requests_in_a_row =3D 0; ssif_info->ssif_state =3D SSIF_GETTING_MESSAGES; ipmi_ssif_unlock_cond(ssif_info, flags); =20 @@ -843,6 +848,11 @@ static void msg_done_handler(struct ssif_info *ssif_in= fo, int result, ssif_info->msg_flags &=3D ~EVENT_MSG_BUFFER_FULL; handle_flags(ssif_info, flags); } else { + ssif_info->num_requests_in_a_row++; + if (ssif_info->num_requests_in_a_row > 10) + /* Stop if we do this too many times. */ + ssif_info->msg_flags &=3D ~EVENT_MSG_BUFFER_FULL; + handle_flags(ssif_info, flags); ssif_inc_stat(ssif_info, events); deliver_recv_msg(ssif_info, msg); @@ -876,6 +886,11 @@ static void msg_done_handler(struct ssif_info *ssif_in= fo, int result, ssif_info->msg_flags &=3D ~RECEIVE_MSG_AVAIL; handle_flags(ssif_info, flags); } else { + ssif_info->num_requests_in_a_row++; + if (ssif_info->num_requests_in_a_row > 10) + /* Stop if we do this too many times. */ + ssif_info->msg_flags &=3D ~RECEIVE_MSG_AVAIL; + ssif_inc_stat(ssif_info, incoming_messages); handle_flags(ssif_info, flags); deliver_recv_msg(ssif_info, msg); --=20 2.43.0