linux-stable.git/drivers/char/ipmi, branch v6.1.4 Linux kernel stable tree ipmi: fix use after free in _ipmi_destroy_user() 2023-01-07T10:11:52+00:00 Dan Carpenter error27@gmail.com 2022-11-15T13:17:43+00:00 1fc9b20a7688000fcf4d7fbaa58e415a3cdda961 commit a92ce570c81dc0feaeb12a429b4bc65686d17967 upstream. The intf_free() function frees the "intf" pointer so we cannot dereference it again on the next line. Fixes: cbb79863fc31 ("ipmi: Don't allow device module unload when in use") Signed-off-by: Dan Carpenter <error27@gmail.com> Message-Id: <Y3M8xa1drZv4CToE@kili> Cc: <stable@vger.kernel.org> # 5.5+ Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit a92ce570c81dc0feaeb12a429b4bc65686d17967 upstream.

The intf_free() function frees the "intf" pointer so we cannot
dereference it again on the next line.

Fixes: cbb79863fc31 ("ipmi: Don't allow device module unload when in use")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Message-Id: <Y3M8xa1drZv4CToE@kili>
Cc: <stable@vger.kernel.org> # 5.5+
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ipmi: fix long wait in unload when IPMI disconnect 2023-01-07T10:11:52+00:00 Zhang Yuchen zhangyuchen.lcr@bytedance.com 2022-10-07T09:26:16+00:00 9c476590feffaf16bfaed8e826afdf7b0f3d6d6e commit f6f1234d98cce69578bfac79df147a1f6660596c upstream. When fixing the problem mentioned in PATCH1, we also found the following problem: If the IPMI is disconnected and in the sending process, the uninstallation driver will be stuck for a long time. The main problem is that uninstalling the driver waits for curr_msg to be sent or HOSED. After stopping tasklet, the only place to trigger the timeout mechanism is the circular poll in shutdown_smi. The poll function delays 10us and calls smi_event_handler(smi_info,10). Smi_event_handler deducts 10us from kcs->ibf_timeout. But the poll func is followed by schedule_timeout_uninterruptible(1). The time consumed here is not counted in kcs->ibf_timeout. So when 10us is deducted from kcs->ibf_timeout, at least 1 jiffies has actually passed. The waiting time has increased by more than a hundredfold. Now instead of calling poll(). call smi_event_handler() directly and calculate the elapsed time. For verification, you can directly use ebpf to check the kcs-> ibf_timeout for each call to kcs_event() when IPMI is disconnected. Decrement at normal rate before unloading. The decrement rate becomes very slow after unloading. $ bpftrace -e 'kprobe:kcs_event {printf("kcs->ibftimeout : %d\n", *(arg0+584));}' Signed-off-by: Zhang Yuchen <zhangyuchen.lcr@bytedance.com> Message-Id: <20221007092617.87597-3-zhangyuchen.lcr@bytedance.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit f6f1234d98cce69578bfac79df147a1f6660596c upstream.

When fixing the problem mentioned in PATCH1, we also found
the following problem:

If the IPMI is disconnected and in the sending process, the
uninstallation driver will be stuck for a long time.

The main problem is that uninstalling the driver waits for curr_msg to
be sent or HOSED. After stopping tasklet, the only place to trigger the
timeout mechanism is the circular poll in shutdown_smi.

The poll function delays 10us and calls smi_event_handler(smi_info,10).
Smi_event_handler deducts 10us from kcs->ibf_timeout.

But the poll func is followed by schedule_timeout_uninterruptible(1).
The time consumed here is not counted in kcs->ibf_timeout.

So when 10us is deducted from kcs->ibf_timeout, at least 1 jiffies has
actually passed. The waiting time has increased by more than a
hundredfold.

Now instead of calling poll(). call smi_event_handler() directly and
calculate the elapsed time.

For verification, you can directly use ebpf to check the kcs->
ibf_timeout for each call to kcs_event() when IPMI is disconnected.
Decrement at normal rate before unloading. The decrement rate becomes
very slow after unloading.

  $ bpftrace -e 'kprobe:kcs_event {printf("kcs->ibftimeout : %d\n",
      *(arg0+584));}'

Signed-off-by: Zhang Yuchen <zhangyuchen.lcr@bytedance.com>
Message-Id: <20221007092617.87597-3-zhangyuchen.lcr@bytedance.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ipmi: fix memleak when unload ipmi driver 2022-12-31T12:32:59+00:00 Zhang Yuchen zhangyuchen.lcr@bytedance.com 2022-10-07T09:26:17+00:00 34cfc4f0327484107f76b11019d50491310c84b6 [ Upstream commit 36992eb6b9b83f7f9cdc8e74fb5799d7b52e83e9 ] After the IPMI disconnect problem, the memory kept rising and we tried to unload the driver to free the memory. However, only part of the free memory is recovered after the driver is uninstalled. Using ebpf to hook free functions, we find that neither ipmi_user nor ipmi_smi_msg is free, only ipmi_recv_msg is free. We find that the deliver_smi_err_response call in clean_smi_msgs does the destroy processing on each message from the xmit_msg queue without checking the return value and free ipmi_smi_msg. deliver_smi_err_response is called only at this location. Adding the free handling has no effect. To verify, try using ebpf to trace the free function. $ bpftrace -e 'kretprobe:ipmi_alloc_recv_msg {printf("alloc rcv %p\n",retval);} kprobe:free_recv_msg {printf("free recv %p\n", arg0)} kretprobe:ipmi_alloc_smi_msg {printf("alloc smi %p\n", retval);} kprobe:free_smi_msg {printf("free smi %p\n",arg0)}' Signed-off-by: Zhang Yuchen <zhangyuchen.lcr@bytedance.com> Message-Id: <20221007092617.87597-4-zhangyuchen.lcr@bytedance.com> [Fixed the comment above handle_one_recv_msg().] Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 36992eb6b9b83f7f9cdc8e74fb5799d7b52e83e9 ]

After the IPMI disconnect problem, the memory kept rising and we tried
to unload the driver to free the memory. However, only part of the
free memory is recovered after the driver is uninstalled. Using
ebpf to hook free functions, we find that neither ipmi_user nor
ipmi_smi_msg is free, only ipmi_recv_msg is free.

We find that the deliver_smi_err_response call in clean_smi_msgs does
the destroy processing on each message from the xmit_msg queue without
checking the return value and free ipmi_smi_msg.

deliver_smi_err_response is called only at this location. Adding the
free handling has no effect.

To verify, try using ebpf to trace the free function.

  $ bpftrace -e 'kretprobe:ipmi_alloc_recv_msg {printf("alloc rcv
      %p\n",retval);} kprobe:free_recv_msg {printf("free recv %p\n",
      arg0)} kretprobe:ipmi_alloc_smi_msg {printf("alloc smi %p\n",
        retval);} kprobe:free_smi_msg {printf("free smi  %p\n",arg0)}'

Signed-off-by: Zhang Yuchen <zhangyuchen.lcr@bytedance.com>
Message-Id: <20221007092617.87597-4-zhangyuchen.lcr@bytedance.com>
[Fixed the comment above handle_one_recv_msg().]
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ipmi: kcs: Poll OBF briefly to reduce OBE latency 2022-12-31T12:32:03+00:00 Andrew Jeffery andrew@aj.id.au 2022-08-12T14:47:41+00:00 3265e0f2f85a6be88d6d187d46d0a31c5c235cb0 [ Upstream commit f90bc0f97f2b65af233a37b2e32fc81871a1e3cf ] The ASPEED KCS devices don't provide a BMC-side interrupt for the host reading the output data register (ODR). The act of the host reading ODR clears the output buffer full (OBF) flag in the status register (STR), informing the BMC it can transmit a subsequent byte. On the BMC side the KCS client must enable the OBE event *and* perform a subsequent read of STR anyway to avoid races - the polling provides a window for the host to read ODR if data was freshly written while minimising BMC-side latency. Fixes: 28651e6c4237 ("ipmi: kcs_bmc: Allow clients to control KCS IRQ state") Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-Id: <20220812144741.240315-1-andrew@aj.id.au> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit f90bc0f97f2b65af233a37b2e32fc81871a1e3cf ]

The ASPEED KCS devices don't provide a BMC-side interrupt for the host
reading the output data register (ODR). The act of the host reading ODR
clears the output buffer full (OBF) flag in the status register (STR),
informing the BMC it can transmit a subsequent byte.

On the BMC side the KCS client must enable the OBE event *and* perform a
subsequent read of STR anyway to avoid races - the polling provides a
window for the host to read ODR if data was freshly written while
minimising BMC-side latency.

Fixes: 28651e6c4237 ("ipmi: kcs_bmc: Allow clients to control KCS IRQ state")
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20220812144741.240315-1-andrew@aj.id.au>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Merge tag 'for-linus-6.1-1' of https://github.com/cminyard/linux-ipmi 2022-10-11T17:42:25+00:00 Linus Torvalds torvalds@linux-foundation.org 2022-10-11T17:42:25+00:00 8de1037a96ef33363727302f9afadb6535fd8b05 Pull IPMI updates from Corey Minyard: "Fix a bunch of little problems in IPMI This is mostly just doc, config, and little tweaks. Nothing big, which is why there was nothing for 6.0. There is one crash fix, but it's not something that I think anyone is using yet" * tag 'for-linus-6.1-1' of https://github.com/cminyard/linux-ipmi: ipmi: Remove unused struct watcher_entry ipmi: kcs: aspeed: Update port address comments ipmi: Add __init/__exit annotations to module init/exit funcs ipmi:ipmb: Don't call ipmi_unregister_smi() on a register failure ipmi:ipmb: Fix a vague comment and a typo dt-binding: ipmi: add fallback to npcm845 compatible ipmi: Fix comment typo char: ipmi: modify NPCM KCS configuration dt-bindings: ipmi: Add npcm845 compatible 
Pull IPMI updates from Corey Minyard:
 "Fix a bunch of little problems in IPMI

  This is mostly just doc, config, and little tweaks. Nothing big, which
  is why there was nothing for 6.0. There is one crash fix, but it's not
  something that I think anyone is using yet"

* tag 'for-linus-6.1-1' of https://github.com/cminyard/linux-ipmi:
  ipmi: Remove unused struct watcher_entry
  ipmi: kcs: aspeed: Update port address comments
  ipmi: Add __init/__exit annotations to module init/exit funcs
  ipmi:ipmb: Don't call ipmi_unregister_smi() on a register failure
  ipmi:ipmb: Fix a vague comment and a typo
  dt-binding: ipmi: add fallback to npcm845 compatible
  ipmi: Fix comment typo
  char: ipmi: modify NPCM KCS configuration
  dt-bindings: ipmi: Add npcm845 compatible
ipmi: Remove unused struct watcher_entry 2022-09-28T11:48:54+00:00 Yuan Can yuancan@huawei.com 2022-09-27T13:38:14+00:00 05763c996f72ef934432639fe412f5193816fd9d After commit e86ee2d44b44("ipmi: Rework locking and shutdown for hot remove"), no one use struct watcher_entry, so remove it. Signed-off-by: Yuan Can <yuancan@huawei.com> Message-Id: <20220927133814.98929-1-yuancan@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> 
After commit e86ee2d44b44("ipmi: Rework locking and shutdown for hot remove"),
no one use struct watcher_entry, so remove it.

Signed-off-by: Yuan Can <yuancan@huawei.com>
Message-Id: <20220927133814.98929-1-yuancan@huawei.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
ipmi: kcs: aspeed: Update port address comments 2022-09-23T00:47:19+00:00 Chia-Wei Wang chiawei_wang@aspeedtech.com 2022-09-20T02:03:33+00:00 6f65540b22afaa9c3d621bfb8b2a2958fedf6179 Remove AST_usrGuide_KCS.pdf as it is no longer maintained. Add more descriptions as the driver now supports the I/O address configurations for both the KCS Data and Cmd/Status interface registers. Signed-off-by: Chia-Wei Wang <chiawei_wang@aspeedtech.com> Message-Id: <20220920020333.601-1-chiawei_wang@aspeedtech.com> [I don't like removing documentation, but the document in question was a personal note by an employee and nothing official and not necessarily guaranteed to be accurate in the future. So go ahead and remove it.] Signed-off-by: Corey Minyard <cminyard@mvista.com> 
Remove AST_usrGuide_KCS.pdf as it is no longer maintained.

Add more descriptions as the driver now supports the I/O
address configurations for both the KCS Data and Cmd/Status
interface registers.

Signed-off-by: Chia-Wei Wang <chiawei_wang@aspeedtech.com>
Message-Id: <20220920020333.601-1-chiawei_wang@aspeedtech.com>
[I don't like removing documentation, but the document in question
 was a personal note by an employee and nothing official and not
 necessarily guaranteed to be accurate in the future.  So go
 ahead and remove it.]
Signed-off-by: Corey Minyard <cminyard@mvista.com>
ipmi: Add __init/__exit annotations to module init/exit funcs 2022-09-22T15:55:46+00:00 Xiu Jianfeng xiujianfeng@huawei.com 2022-09-22T11:19:24+00:00 ec7174f637d75abe5ada8482b9947898db231cd2 Add missing __init/__exit annotations to module init/exit funcs. Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> Message-Id: <20220922111924.36044-1-xiujianfeng@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> 
Add missing __init/__exit annotations to module init/exit funcs.

Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Message-Id: <20220922111924.36044-1-xiujianfeng@huawei.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
ipmi:ipmb: Don't call ipmi_unregister_smi() on a register failure 2022-09-10T01:34:24+00:00 Corey Minyard minyard@acm.org 2022-09-10T01:31:39+00:00 80d98a33008cbfd9ed0271b0e253ff88b51f96ac The data structure won't be set up to be unregistered, and it can result in crashes if the register fails. Signed-off-by: Corey Minyard <minyard@acm.org> 
The data structure won't be set up to be unregistered, and it can result in
crashes if the register fails.

Signed-off-by: Corey Minyard <minyard@acm.org>
ipmi:ipmb: Fix a vague comment and a typo 2022-09-04T16:43:14+00:00 Corey Minyard cminyard@mvista.com 2022-09-04T16:43:14+00:00 ba5829c6543fbcf0b31854cc6970b9012ff71279 Sending an IPMI response message gets a reponse to the response, but the comment saying that just said "response response", which is hard to understand. Also fix an obvious typo. Reported-by: Shaomin Deng <dengshaomin@cdjrlc.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> 
Sending an IPMI response message gets a reponse to the response, but the
comment saying that just said "response response", which is hard to
understand.  Also fix an obvious typo.

Reported-by: Shaomin Deng <dengshaomin@cdjrlc.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>