linux-kernel - [PATCH] ipmi: ssif_bmc: Fix new request loss when bmc ready for a response

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250107034734.1842247-1-quan@os.amperecomputing.com>
Date: Tue,  7 Jan 2025 10:47:34 +0700
From: Quan Nguyen <quan@...amperecomputing.com>
To: minyard@....org,
	Cosmo Chou <chou.cosmo@...il.com>
Cc: patches@...erecomputing.com,
	openipmi-developer@...ts.sourceforge.net,
	linux-kernel@...r.kernel.org,
	cosmo.chou@...ntatw.com,
	potin.lai@...ntatw.com,
	Quan Nguyen <quan@...amperecomputing.com>
Subject: [PATCH] ipmi: ssif_bmc: Fix new request loss when bmc ready for a response

Cosmo found that when there is a new request comes in while BMC is
ready for a response, the complete_response(), which is called to
complete the pending response, would accidentally clear out that new
request and force ssif_bmc to move back to abort state again.

This commit is to address that issue.

Link: https://lore.kernel.org/lkml/20250101165431.2113407-1-chou.cosmo@gmail.com/
Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver")
Found-by: Cosmo Chou <chou.cosmo@...il.com>
Signed-off-by: Quan Nguyen <quan@...amperecomputing.com>
---
 drivers/char/ipmi/ssif_bmc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/char/ipmi/ssif_bmc.c b/drivers/char/ipmi/ssif_bmc.c
index a14fafc583d4..310f17dd9511 100644
--- a/drivers/char/ipmi/ssif_bmc.c
+++ b/drivers/char/ipmi/ssif_bmc.c
@@ -292,7 +292,6 @@ static void complete_response(struct ssif_bmc_ctx *ssif_bmc)
 	ssif_bmc->nbytes_processed = 0;
 	ssif_bmc->remain_len = 0;
 	ssif_bmc->busy = false;
-	memset(&ssif_bmc->part_buf, 0, sizeof(struct ssif_part_buffer));
 	wake_up_all(&ssif_bmc->wait_queue);
 }
 
@@ -744,9 +743,11 @@ static void on_stop_event(struct ssif_bmc_ctx *ssif_bmc, u8 *val)
 			ssif_bmc->aborting = true;
 		}
 	} else if (ssif_bmc->state == SSIF_RES_SENDING) {
-		if (ssif_bmc->is_singlepart_read || ssif_bmc->block_num == 0xFF)
+		if (ssif_bmc->is_singlepart_read || ssif_bmc->block_num == 0xFF) {
+			memset(&ssif_bmc->part_buf, 0, sizeof(struct ssif_part_buffer));
 			/* Invalidate response buffer to denote it is sent */
 			complete_response(ssif_bmc);
+		}
 		ssif_bmc->state = SSIF_READY;
 	}
 
-- 
2.35.1