lkml.org 
[lkml]   [2014]   [Nov]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.16.y-ckt 174/254] hwrng: pseries - port to new read API and fix stack corruption
    Date
    3.16.7-ckt2 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Greg Kurz <gkurz@linux.vnet.ibm.com>

    commit 24c65bc7037e7d0f362c0df70d17dd72ee64b8b9 upstream.

    The add_early_randomness() function in drivers/char/hw_random/core.c passes
    a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
    returns four 64-bit values and trashes 16 bytes on the stack.

    This bug has been lying around for a long time. It got unveiled by:

    commit d3cc7996473a7bdd33256029988ea690754e4e2a
    Author: Amit Shah <amit.shah@redhat.com>
    Date: Thu Jul 10 15:42:34 2014 +0530

    hwrng: fetch randomness only after device init

    It may trig a oops while loading or unloading the pseries-rng module for both
    PowerVM and PowerKVM guests.

    This patch does two things:
    - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
    since we're not on a hot path.
    - move to the new read API so that we know the return buffer size for sure.

    Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    drivers/char/hw_random/pseries-rng.c | 11 +++++++----
    1 file changed, 7 insertions(+), 4 deletions(-)

    diff --git a/drivers/char/hw_random/pseries-rng.c b/drivers/char/hw_random/pseries-rng.c
    index ab7ffdec0ec3..f38f2c13e79c 100644
    --- a/drivers/char/hw_random/pseries-rng.c
    +++ b/drivers/char/hw_random/pseries-rng.c
    @@ -25,18 +25,21 @@
    #include <asm/vio.h>


    -static int pseries_rng_data_read(struct hwrng *rng, u32 *data)
    +static int pseries_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
    {
    + u64 buffer[PLPAR_HCALL_BUFSIZE];
    + size_t size = max < 8 ? max : 8;
    int rc;

    - rc = plpar_hcall(H_RANDOM, (unsigned long *)data);
    + rc = plpar_hcall(H_RANDOM, (unsigned long *)buffer);
    if (rc != H_SUCCESS) {
    pr_err_ratelimited("H_RANDOM call failed %d\n", rc);
    return -EIO;
    }
    + memcpy(data, buffer, size);

    /* The hypervisor interface returns 64 bits */
    - return 8;
    + return size;
    }

    /**
    @@ -55,7 +58,7 @@ static unsigned long pseries_rng_get_desired_dma(struct vio_dev *vdev)

    static struct hwrng pseries_rng = {
    .name = KBUILD_MODNAME,
    - .data_read = pseries_rng_data_read,
    + .read = pseries_rng_read,
    };

    static int __init pseries_rng_probe(struct vio_dev *dev,
    --
    2.1.0


    \
     
     \ /
      Last update: 2014-11-25 12:41    [W:2.527 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site