From 428ef0dc9e20039f2f34f93d1d5f7d8de65764fd Mon Sep 17 00:00:00 2001 From: Corey Minyard Date: Tue, 20 Apr 2021 19:46:36 +0800 Subject: [PATCH] ipmi: Fix return value when a message is truncated mainline inclusion from mainline-5.1 commit 95ac0daa0ca98ad8ac23769021144f8bf04cf406 category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- The user can ask the message to be returned even if it didn't supply enough memory for the data, and it will return an error but still fills in as much data as possible. However, the return value wasn't being set to an error, it was being overwritten. Create a second return value for that case. Signed-off-by: Corey Minyard Signed-off-by: Wenchao Hao Reviewed-by: Miaohe Lin Signed-off-by: Yang Yingliang --- drivers/char/ipmi/ipmi_devintf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c index 1a486aec99b6..825045312991 100644 --- a/drivers/char/ipmi/ipmi_devintf.c +++ b/drivers/char/ipmi/ipmi_devintf.c @@ -207,7 +207,7 @@ static int handle_recv(struct ipmi_file_private *priv, struct list_head *entry; struct ipmi_recv_msg *msg; unsigned long flags; - int rv = 0; + int rv = 0, rv2 = 0; /* We claim a mutex because we don't want two users getting something from the queue at a time. @@ -250,7 +250,7 @@ static int handle_recv(struct ipmi_file_private *priv, if (msg->msg.data_len > 0) { if (rsp->msg.data_len < msg->msg.data_len) { - rv = -EMSGSIZE; + rv2 = -EMSGSIZE; if (trunc) msg->msg.data_len = rsp->msg.data_len; else @@ -274,7 +274,7 @@ static int handle_recv(struct ipmi_file_private *priv, mutex_unlock(&priv->recv_mutex); ipmi_free_recv_msg(msg); - return 0; + return rv2; recv_putback_on_err: /* If we got an error, put the message back onto -- GitLab