linux-stable.git/drivers/char/ipmi, branch v6.6.78 Linux kernel stable tree ipmi: ssif_bmc: Fix new request loss when bmc ready for a response 2025-02-08T08:51:55+00:00 Quan Nguyen quan@os.amperecomputing.com 2025-01-07T03:47:34+00:00 2851acb600d66ba3ebba209864367c8025a5326c [ Upstream commit 83d8c79aa958e37724ed9c14dc7d0f66a48ad864 ] Cosmo found that when there is a new request comes in while BMC is ready for a response, the complete_response(), which is called to complete the pending response, would accidentally clear out that new request and force ssif_bmc to move back to abort state again. This commit is to address that issue. Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver") Reported-by: Cosmo Chou <chou.cosmo@gmail.com> Closes: https://lore.kernel.org/lkml/20250101165431.2113407-1-chou.cosmo@gmail.com/ Signed-off-by: Quan Nguyen <quan@os.amperecomputing.com> Message-ID: <20250107034734.1842247-1-quan@os.amperecomputing.com> Signed-off-by: Corey Minyard <corey@minyard.net> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 83d8c79aa958e37724ed9c14dc7d0f66a48ad864 ]

Cosmo found that when there is a new request comes in while BMC is
ready for a response, the complete_response(), which is called to
complete the pending response, would accidentally clear out that new
request and force ssif_bmc to move back to abort state again.

This commit is to address that issue.

Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver")
Reported-by: Cosmo Chou <chou.cosmo@gmail.com>
Closes: https://lore.kernel.org/lkml/20250101165431.2113407-1-chou.cosmo@gmail.com/
Signed-off-by: Quan Nguyen <quan@os.amperecomputing.com>
Message-ID: <20250107034734.1842247-1-quan@os.amperecomputing.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ipmi: ipmb: Add check devm_kasprintf() returned value 2025-02-08T08:51:48+00:00 Charles Han hanchunchao@inspur.com 2024-09-26T09:44:19+00:00 4c9caf86d04dcb10e9fd8cd9db8eb79b5bfcc4d8 [ Upstream commit 2378bd0b264ad3a1f76bd957caf33ee0c7945351 ] devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked. Fixes: 51bd6f291583 ("Add support for IPMB driver") Signed-off-by: Charles Han <hanchunchao@inspur.com> Message-ID: <20240926094419.25900-1-hanchunchao@inspur.com> Signed-off-by: Corey Minyard <corey@minyard.net> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 2378bd0b264ad3a1f76bd957caf33ee0c7945351 ]

devm_kasprintf() can return a NULL pointer on failure but this
returned value is not checked.

Fixes: 51bd6f291583 ("Add support for IPMB driver")
Signed-off-by: Charles Han <hanchunchao@inspur.com>
Message-ID: <20240926094419.25900-1-hanchunchao@inspur.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
ipmi: ssif_bmc: prevent integer overflow on 32bit systems 2024-08-03T06:53:48+00:00 Dan Carpenter dan.carpenter@linaro.org 2024-06-14T17:30:44+00:00 fa6950e4dab8ebbadee17dc236c367bb789fe3e7 [ Upstream commit 0627cef36145c9ff9845bdfd7ddf485bbac1f981 ] There are actually two bugs here. First, we need to ensure that count is at least sizeof(u32) or msg.len will be uninitialized data. The "msg.len" variable is a u32 that comes from the user. On 32bit systems the "sizeof_field(struct ipmi_ssif_msg, len) + msg.len" addition can overflow if "msg.len" is greater than U32_MAX - 4. Valid lengths for "msg.len" are 1-254. Add a check for that to prevent the integer overflow. Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Message-Id: <1431ca2e-4e9c-4520-bfc0-6879313c30e9@moroto.mountain> Signed-off-by: Corey Minyard <corey@minyard.net> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 0627cef36145c9ff9845bdfd7ddf485bbac1f981 ]

There are actually two bugs here.  First, we need to ensure that count
is at least sizeof(u32) or msg.len will be uninitialized data.

The "msg.len" variable is a u32 that comes from the user.  On 32bit
systems the "sizeof_field(struct ipmi_ssif_msg, len) + msg.len"
addition can overflow if "msg.len" is greater than U32_MAX - 4.

Valid lengths for "msg.len" are 1-254.  Add a check for that to
prevent the integer overflow.

Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Message-Id: <1431ca2e-4e9c-4520-bfc0-6879313c30e9@moroto.mountain>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Merge tag 'for-linus-6.6-1' of https://github.com/cminyard/linux-ipmi 2023-08-31T02:20:35+00:00 Linus Torvalds torvalds@linux-foundation.org 2023-08-31T02:20:35+00:00 a55b0a028877e9d7e7dacdbe363d39390554ba14 Pull IPMI updates from Corey Minyard: "Minor fixes for IPMI Lots of small unconnected things, memory leaks on error, a possible (though unlikely) deadlock, changes for updates to other things that have changed. Nothing earth-shattering, but things that need update" * tag 'for-linus-6.6-1' of https://github.com/cminyard/linux-ipmi: ipmi_si: fix -Wvoid-pointer-to-enum-cast warning ipmi: fix potential deadlock on &kcs_bmc->lock ipmi_si: fix a memleak in try_smi_init() ipmi: Change request_module to request_module_nowait ipmi: make ipmi_class a static const structure ipmi:ssif: Fix a memory leak when scanning for an adapter ipmi:ssif: Add check for kstrdup dt-bindings: ipmi: aspeed,ast2400-kcs-bmc: drop unneeded quotes ipmi: Switch i2c drivers back to use .probe() ipmi_watchdog: Fix read syscall not responding to signals during sleep 
Pull IPMI updates from Corey Minyard:
 "Minor fixes for IPMI

  Lots of small unconnected things, memory leaks on error, a possible
  (though unlikely) deadlock, changes for updates to other things that
  have changed. Nothing earth-shattering, but things that need update"

* tag 'for-linus-6.6-1' of https://github.com/cminyard/linux-ipmi:
  ipmi_si: fix -Wvoid-pointer-to-enum-cast warning
  ipmi: fix potential deadlock on &kcs_bmc->lock
  ipmi_si: fix a memleak in try_smi_init()
  ipmi: Change request_module to request_module_nowait
  ipmi: make ipmi_class a static const structure
  ipmi:ssif: Fix a memory leak when scanning for an adapter
  ipmi:ssif: Add check for kstrdup
  dt-bindings: ipmi: aspeed,ast2400-kcs-bmc: drop unneeded quotes
  ipmi: Switch i2c drivers back to use .probe()
  ipmi_watchdog: Fix read syscall not responding to signals during sleep
ipmi: Explicitly include correct DT includes 2023-08-28T18:36:24+00:00 Rob Herring robh@kernel.org 2023-07-28T13:48:18+00:00 86cdae14a58a877ee1ec79d39b1331bc98dace58 The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it was merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Link: https://lore.kernel.org/r/20230728134819.3224045-1-robh@kernel.org Signed-off-by: Rob Herring <robh@kernel.org> 
The DT of_device.h and of_platform.h date back to the separate
of_platform_bus_type before it was merged into the regular platform bus.
As part of that merge prepping Arm DT support 13 years ago, they
"temporarily" include each other. They also include platform_device.h
and of.h. As a result, there's a pretty much random mix of those include
files used throughout the tree. In order to detangle these headers and
replace the implicit includes with struct declarations, users need to
explicitly include the correct includes.

Link: https://lore.kernel.org/r/20230728134819.3224045-1-robh@kernel.org
Signed-off-by: Rob Herring <robh@kernel.org>
ipmi_si: fix -Wvoid-pointer-to-enum-cast warning 2023-08-15T20:46:06+00:00 Justin Stitt justinstitt@google.com 2023-08-09T21:05:17+00:00 d40f09c1a23024f0e550d9423f4d389672e1dfaf With W=1 we see the following warning: | drivers/char/ipmi/ipmi_si_platform.c:272:15: error: \ | cast to smaller integer type 'enum si_type' from \ | 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] | 272 | io.si_type = (enum si_type) match->data; | | ^~~~~~~~~~~~~~~~~~~~~~~~~~ This is due to the fact that the `si_type` enum members are int-width and a cast from pointer-width down to int will cause truncation and possible data loss. Although in this case `si_type` has only a few enumerated fields and thus there is likely no data loss occurring. Nonetheless, this patch is necessary to the goal of promoting this warning out of W=1. Link: https://github.com/ClangBuiltLinux/linux/issues/1902 Link: https://lore.kernel.org/llvm/202308081000.tTL1ElTr-lkp@intel.com/ Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Justin Stitt <justinstitt@google.com> Message-Id: <20230809-cbl-1902-v1-1-92def12d1dea@google.com> Signed-off-by: Corey Minyard <minyard@acm.org> 
With W=1 we see the following warning:

|  drivers/char/ipmi/ipmi_si_platform.c:272:15: error: \
|       cast to smaller integer type 'enum si_type' from \
|       'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
|    272 |         io.si_type      = (enum si_type) match->data;
|        |                           ^~~~~~~~~~~~~~~~~~~~~~~~~~

This is due to the fact that the `si_type` enum members are int-width
and a cast from pointer-width down to int will cause truncation and
possible data loss. Although in this case `si_type` has only a few
enumerated fields and thus there is likely no data loss occurring.
Nonetheless, this patch is necessary to the goal of promoting this
warning out of W=1.

Link: https://github.com/ClangBuiltLinux/linux/issues/1902
Link: https://lore.kernel.org/llvm/202308081000.tTL1ElTr-lkp@intel.com/
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Justin Stitt <justinstitt@google.com>
Message-Id: <20230809-cbl-1902-v1-1-92def12d1dea@google.com>
Signed-off-by: Corey Minyard <minyard@acm.org>
ipmi: fix potential deadlock on &kcs_bmc->lock 2023-07-04T14:22:45+00:00 Chengfeng Ye dg573847474@gmail.com 2023-06-27T15:24:49+00:00 b02bb79eee074f07acdfde540f2d4fe2a04471d8 As kcs_bmc_handle_event() is executed inside both a timer and a hardirq, it should disable irq before lock acquisition otherwise deadlock could happen if the timmer is preemtped by the irq. Possible deadlock scenario: aspeed_kcs_check_obe() (timer) -> kcs_bmc_handle_event() -> spin_lock(&kcs_bmc->lock) <irq interruption> -> aspeed_kcs_irq() -> kcs_bmc_handle_event() -> spin_lock(&kcs_bmc->lock) (deadlock here) This flaw was found using an experimental static analysis tool we are developing for irq-related deadlock. The tentative patch fix the potential deadlock by spin_lock_irqsave() Signed-off-by: Chengfeng Ye <dg573847474@gmail.com> Message-Id: <20230627152449.36093-1-dg573847474@gmail.com> Signed-off-by: Corey Minyard <minyard@acm.org> 
As kcs_bmc_handle_event() is executed inside both a timer and a hardirq,
it should disable irq before lock acquisition otherwise deadlock could
happen if the timmer is preemtped by the irq.

Possible deadlock scenario:
aspeed_kcs_check_obe() (timer)
    -> kcs_bmc_handle_event()
    -> spin_lock(&kcs_bmc->lock)
        <irq interruption>
        -> aspeed_kcs_irq()
        -> kcs_bmc_handle_event()
        -> spin_lock(&kcs_bmc->lock) (deadlock here)

This flaw was found using an experimental static analysis tool we are
developing for irq-related deadlock.

The tentative patch fix the potential deadlock by spin_lock_irqsave()

Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Message-Id: <20230627152449.36093-1-dg573847474@gmail.com>
Signed-off-by: Corey Minyard <minyard@acm.org>
ipmi_si: fix a memleak in try_smi_init() 2023-06-29T13:06:45+00:00 Yi Yang yiyang13@huawei.com 2023-06-29T12:33:28+00:00 6cf1a126de2992b4efe1c3c4d398f8de4aed6e3f Kmemleak reported the following leak info in try_smi_init(): unreferenced object 0xffff00018ecf9400 (size 1024): comm "modprobe", pid 2707763, jiffies 4300851415 (age 773.308s) backtrace: [<000000004ca5b312>] __kmalloc+0x4b8/0x7b0 [<00000000953b1072>] try_smi_init+0x148/0x5dc [ipmi_si] [<000000006460d325>] 0xffff800081b10148 [<0000000039206ea5>] do_one_initcall+0x64/0x2a4 [<00000000601399ce>] do_init_module+0x50/0x300 [<000000003c12ba3c>] load_module+0x7a8/0x9e0 [<00000000c246fffe>] __se_sys_init_module+0x104/0x180 [<00000000eea99093>] __arm64_sys_init_module+0x24/0x30 [<0000000021b1ef87>] el0_svc_common.constprop.0+0x94/0x250 [<0000000070f4f8b7>] do_el0_svc+0x48/0xe0 [<000000005a05337f>] el0_svc+0x24/0x3c [<000000005eb248d6>] el0_sync_handler+0x160/0x164 [<0000000030a59039>] el0_sync+0x160/0x180 The problem was that when an error occurred before handlers registration and after allocating `new_smi->si_sm`, the variable wouldn't be freed in the error handling afterwards since `shutdown_smi()` hadn't been registered yet. Fix it by adding a `kfree()` in the error handling path in `try_smi_init()`. Cc: stable@vger.kernel.org # 4.19+ Fixes: 7960f18a5647 ("ipmi_si: Convert over to a shutdown handler") Signed-off-by: Yi Yang <yiyang13@huawei.com> Co-developed-by: GONG, Ruiqi <gongruiqi@huaweicloud.com> Signed-off-by: GONG, Ruiqi <gongruiqi@huaweicloud.com> Message-Id: <20230629123328.2402075-1-gongruiqi@huaweicloud.com> Signed-off-by: Corey Minyard <minyard@acm.org> 
Kmemleak reported the following leak info in try_smi_init():

unreferenced object 0xffff00018ecf9400 (size 1024):
  comm "modprobe", pid 2707763, jiffies 4300851415 (age 773.308s)
  backtrace:
    [<000000004ca5b312>] __kmalloc+0x4b8/0x7b0
    [<00000000953b1072>] try_smi_init+0x148/0x5dc [ipmi_si]
    [<000000006460d325>] 0xffff800081b10148
    [<0000000039206ea5>] do_one_initcall+0x64/0x2a4
    [<00000000601399ce>] do_init_module+0x50/0x300
    [<000000003c12ba3c>] load_module+0x7a8/0x9e0
    [<00000000c246fffe>] __se_sys_init_module+0x104/0x180
    [<00000000eea99093>] __arm64_sys_init_module+0x24/0x30
    [<0000000021b1ef87>] el0_svc_common.constprop.0+0x94/0x250
    [<0000000070f4f8b7>] do_el0_svc+0x48/0xe0
    [<000000005a05337f>] el0_svc+0x24/0x3c
    [<000000005eb248d6>] el0_sync_handler+0x160/0x164
    [<0000000030a59039>] el0_sync+0x160/0x180

The problem was that when an error occurred before handlers registration
and after allocating `new_smi->si_sm`, the variable wouldn't be freed in
the error handling afterwards since `shutdown_smi()` hadn't been
registered yet. Fix it by adding a `kfree()` in the error handling path
in `try_smi_init()`.

Cc: stable@vger.kernel.org # 4.19+
Fixes: 7960f18a5647 ("ipmi_si: Convert over to a shutdown handler")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Co-developed-by: GONG, Ruiqi <gongruiqi@huaweicloud.com>
Signed-off-by: GONG, Ruiqi <gongruiqi@huaweicloud.com>
Message-Id: <20230629123328.2402075-1-gongruiqi@huaweicloud.com>
Signed-off-by: Corey Minyard <minyard@acm.org>
ipmi: Change request_module to request_module_nowait 2023-06-20T14:59:53+00:00 Corey Minyard minyard@acm.org 2023-06-20T14:59:53+00:00 e87443a5f68da7bacefe933c90453ae7215263b3 When probing for an ACPI-specified IPMI device, the code would request that the acpi_ipmi module be loaded ACPI operations through IPMI can be performed. This could happen through module load context, for instance, if an I2C module is loaded that caused the IPMI interface to be probed. This is not allowed because a synchronous module load in this context can result in an deadlock, and I was getting a warning: [ 23.967853] WARNING: CPU: 0 PID: 21 at kernel/module/kmod.c:144 __request_module+0x1de/0x2d0 [ 23.968852] Modules linked in: i2c_i801 ipmi_ssif The IPMI driver is not dependent on acpi_ipmi, so just change the called to request_module_nowait to make the load asynchronous. Signed-off-by: Corey Minyard <minyard@acm.org> 
When probing for an ACPI-specified IPMI device, the code would request
that the acpi_ipmi module be loaded ACPI operations through IPMI can be
performed.  This could happen through module load context, for instance,
if an I2C module is loaded that caused the IPMI interface to be probed.

This is not allowed because a synchronous module load in this context
can result in an deadlock, and I was getting a warning:

[   23.967853] WARNING: CPU: 0 PID: 21 at kernel/module/kmod.c:144 __request_module+0x1de/0x2d0
[   23.968852] Modules linked in: i2c_i801 ipmi_ssif

The IPMI driver is not dependent on acpi_ipmi, so just change the called
to request_module_nowait to make the load asynchronous.

Signed-off-by: Corey Minyard <minyard@acm.org>
ipmi: make ipmi_class a static const structure 2023-06-20T14:49:08+00:00 Ivan Orlov ivan.orlov0322@gmail.com 2023-06-20T14:37:02+00:00 392fa3a3abdb03105c8767b7fb176bc8793349f5 Now that the driver core allows for struct class to be in read-only memory, move the ipmi_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at boot time. Cc: Corey Minyard <minyard@acm.org> Cc: openipmi-developer@lists.sourceforge.net Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Message-Id: <20230620143701.577657-2-gregkh@linuxfoundation.org> Signed-off-by: Corey Minyard <minyard@acm.org> 
Now that the driver core allows for struct class to be in read-only
memory, move the ipmi_class structure to be declared at build time
placing it into read-only memory, instead of having to be dynamically
allocated at boot time.

Cc: Corey Minyard <minyard@acm.org>
Cc: openipmi-developer@lists.sourceforge.net
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Message-Id: <20230620143701.577657-2-gregkh@linuxfoundation.org>
Signed-off-by: Corey Minyard <minyard@acm.org>