ipmi: ipmb: Fix off-by-one size check on rcvlen
authorColin Ian King <colin.king@canonical.com>
Tue, 5 Oct 2021 15:16:11 +0000 (16:16 +0100)
committerCorey Minyard <cminyard@mvista.com>
Tue, 5 Oct 2021 15:39:37 +0000 (10:39 -0500)
commit39ce73504695500e043d2851e3d4938fcae89399
tree51a30c9c426a49d46cd5a3ff9d3c35b454d1bc39
parent8332cd4936ed93df42add6541f740ce937e7a5bc
ipmi: ipmb: Fix off-by-one size check on rcvlen

There is an off-by-one bounds check on the rcvlen causing a potential
out of bounds write on iidev->rcvmsg. Fix this by using the >= operator
on the bounds check rather than the > operator.

Addresses-Coverity: ("Out-of-bounds write")
Fixes: 0ba0c3c5d1c1 ("ipmi:ipmb: Add initial support for IPMI over IPMB")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Message-Id: <20211005151611.305383-1-colin.king@canonical.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
drivers/char/ipmi/ipmi_ipmb.c