linux-stable.git/drivers/char/ipmi, branch v6.7 Linux kernel stable tree Merge tag 'for-linus-6.7-1' of https://github.com/cminyard/linux-ipmi 2023-11-03T01:01:33+00:00 Linus Torvalds torvalds@linux-foundation.org 2023-11-03T01:01:33+00:00 e5760335882bd91137873b8f2230b6c1f91da52b Pull IPMI update from Corey Minyard: "Only one change, and I would normally just wait, but it will make the people trying to get rid of strncpy happy. Its a good change, anyway" * tag 'for-linus-6.7-1' of https://github.com/cminyard/linux-ipmi: ipmi: refactor deprecated strncpy 
Pull IPMI update from Corey Minyard:
 "Only one change, and I would normally just wait, but it will make the
  people trying to get rid of strncpy happy. Its a good change, anyway"

* tag 'for-linus-6.7-1' of https://github.com/cminyard/linux-ipmi:
  ipmi: refactor deprecated strncpy
char-misc: Remove the now superfluous sentinel element from ctl_table array 2023-10-11T19:16:13+00:00 Joel Granados j.granados@samsung.com 2023-10-02T08:55:26+00:00 ed1aa959b50854bddd7252d404aa6fdbcfa60b99 This commit comes at the tail end of a greater effort to remove the empty elements at the end of the ctl_table arrays (sentinels) which will reduce the overall build time size of the kernel and run time memory bloat by ~64 bytes per sentinel (further information Link : https://lore.kernel.org/all/ZO5Yx5JFogGi%2FcBo@bombadil.infradead.org/) Remove sentinel from impi_table and random_table Signed-off-by: Joel Granados <j.granados@samsung.com> Signed-off-by: Luis Chamberlain <mcgrof@kernel.org> 
This commit comes at the tail end of a greater effort to remove the
empty elements at the end of the ctl_table arrays (sentinels) which
will reduce the overall build time size of the kernel and run time
memory bloat by ~64 bytes per sentinel (further information Link :
https://lore.kernel.org/all/ZO5Yx5JFogGi%2FcBo@bombadil.infradead.org/)

Remove sentinel from impi_table and random_table

Signed-off-by: Joel Granados <j.granados@samsung.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
ipmi: refactor deprecated strncpy 2023-09-13T17:55:11+00:00 Justin Stitt justinstitt@google.com 2023-09-13T17:13:04+00:00 b00839ca4cca8aa9641c121c848a553d6220ce70 `strncpy` is deprecated for use on NUL-terminated destination strings [1]. In this case, strncpy is being used specifically for its NUL-padding behavior (and has been commented as such). Moreover, the destination string is not required to be NUL-terminated [2]. We can use a more robust and less ambiguous interface in `memcpy_and_pad` which makes the code more readable and even eliminates the need for that comment. Let's also use `strnlen` instead of `strlen()` with an upper-bounds check as this is intrinsically a part of `strnlen`. Also included in this patch is a simple 1:1 change of `strncpy` to `strscpy` for ipmi_ssif.c. If NUL-padding is wanted here as well then we should opt again for `strscpy_pad`. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://lore.kernel.org/all/ZQEADYBl0uZ1nX60@mail.minyard.net/ [2] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Justin Stitt <justinstitt@google.com> Message-Id: <20230913-strncpy-drivers-char-ipmi-ipmi-v2-1-e3bc0f6e599f@google.com> Signed-off-by: Corey Minyard <minyard@acm.org> 
`strncpy` is deprecated for use on NUL-terminated destination strings [1].

In this case, strncpy is being used specifically for its NUL-padding
behavior (and has been commented as such). Moreover, the destination
string is not required to be NUL-terminated [2].

We can use a more robust and less ambiguous interface in
`memcpy_and_pad` which makes the code more readable and even eliminates
the need for that comment.

Let's also use `strnlen` instead of `strlen()` with an upper-bounds
check as this is intrinsically a part of `strnlen`.

Also included in this patch is a simple 1:1 change of `strncpy` to
`strscpy` for ipmi_ssif.c. If NUL-padding is wanted here as well then we
should opt again for `strscpy_pad`.

Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
Link: https://lore.kernel.org/all/ZQEADYBl0uZ1nX60@mail.minyard.net/ [2]
Link: https://github.com/KSPP/linux/issues/90
Cc: linux-hardening@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Justin Stitt <justinstitt@google.com>
Message-Id: <20230913-strncpy-drivers-char-ipmi-ipmi-v2-1-e3bc0f6e599f@google.com>
Signed-off-by: Corey Minyard <minyard@acm.org>
Merge tag 'for-linus-6.6-1' of https://github.com/cminyard/linux-ipmi 2023-08-31T02:20:35+00:00 Linus Torvalds torvalds@linux-foundation.org 2023-08-31T02:20:35+00:00 a55b0a028877e9d7e7dacdbe363d39390554ba14 Pull IPMI updates from Corey Minyard: "Minor fixes for IPMI Lots of small unconnected things, memory leaks on error, a possible (though unlikely) deadlock, changes for updates to other things that have changed. Nothing earth-shattering, but things that need update" * tag 'for-linus-6.6-1' of https://github.com/cminyard/linux-ipmi: ipmi_si: fix -Wvoid-pointer-to-enum-cast warning ipmi: fix potential deadlock on &kcs_bmc->lock ipmi_si: fix a memleak in try_smi_init() ipmi: Change request_module to request_module_nowait ipmi: make ipmi_class a static const structure ipmi:ssif: Fix a memory leak when scanning for an adapter ipmi:ssif: Add check for kstrdup dt-bindings: ipmi: aspeed,ast2400-kcs-bmc: drop unneeded quotes ipmi: Switch i2c drivers back to use .probe() ipmi_watchdog: Fix read syscall not responding to signals during sleep 
Pull IPMI updates from Corey Minyard:
 "Minor fixes for IPMI

  Lots of small unconnected things, memory leaks on error, a possible
  (though unlikely) deadlock, changes for updates to other things that
  have changed. Nothing earth-shattering, but things that need update"

* tag 'for-linus-6.6-1' of https://github.com/cminyard/linux-ipmi:
  ipmi_si: fix -Wvoid-pointer-to-enum-cast warning
  ipmi: fix potential deadlock on &kcs_bmc->lock
  ipmi_si: fix a memleak in try_smi_init()
  ipmi: Change request_module to request_module_nowait
  ipmi: make ipmi_class a static const structure
  ipmi:ssif: Fix a memory leak when scanning for an adapter
  ipmi:ssif: Add check for kstrdup
  dt-bindings: ipmi: aspeed,ast2400-kcs-bmc: drop unneeded quotes
  ipmi: Switch i2c drivers back to use .probe()
  ipmi_watchdog: Fix read syscall not responding to signals during sleep
ipmi: Explicitly include correct DT includes 2023-08-28T18:36:24+00:00 Rob Herring robh@kernel.org 2023-07-28T13:48:18+00:00 86cdae14a58a877ee1ec79d39b1331bc98dace58 The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it was merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Link: https://lore.kernel.org/r/20230728134819.3224045-1-robh@kernel.org Signed-off-by: Rob Herring <robh@kernel.org> 
The DT of_device.h and of_platform.h date back to the separate
of_platform_bus_type before it was merged into the regular platform bus.
As part of that merge prepping Arm DT support 13 years ago, they
"temporarily" include each other. They also include platform_device.h
and of.h. As a result, there's a pretty much random mix of those include
files used throughout the tree. In order to detangle these headers and
replace the implicit includes with struct declarations, users need to
explicitly include the correct includes.

Link: https://lore.kernel.org/r/20230728134819.3224045-1-robh@kernel.org
Signed-off-by: Rob Herring <robh@kernel.org>
ipmi_si: fix -Wvoid-pointer-to-enum-cast warning 2023-08-15T20:46:06+00:00 Justin Stitt justinstitt@google.com 2023-08-09T21:05:17+00:00 d40f09c1a23024f0e550d9423f4d389672e1dfaf With W=1 we see the following warning: | drivers/char/ipmi/ipmi_si_platform.c:272:15: error: \ | cast to smaller integer type 'enum si_type' from \ | 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] | 272 | io.si_type = (enum si_type) match->data; | | ^~~~~~~~~~~~~~~~~~~~~~~~~~ This is due to the fact that the `si_type` enum members are int-width and a cast from pointer-width down to int will cause truncation and possible data loss. Although in this case `si_type` has only a few enumerated fields and thus there is likely no data loss occurring. Nonetheless, this patch is necessary to the goal of promoting this warning out of W=1. Link: https://github.com/ClangBuiltLinux/linux/issues/1902 Link: https://lore.kernel.org/llvm/202308081000.tTL1ElTr-lkp@intel.com/ Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Justin Stitt <justinstitt@google.com> Message-Id: <20230809-cbl-1902-v1-1-92def12d1dea@google.com> Signed-off-by: Corey Minyard <minyard@acm.org> 
With W=1 we see the following warning:

|  drivers/char/ipmi/ipmi_si_platform.c:272:15: error: \
|       cast to smaller integer type 'enum si_type' from \
|       'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
|    272 |         io.si_type      = (enum si_type) match->data;
|        |                           ^~~~~~~~~~~~~~~~~~~~~~~~~~

This is due to the fact that the `si_type` enum members are int-width
and a cast from pointer-width down to int will cause truncation and
possible data loss. Although in this case `si_type` has only a few
enumerated fields and thus there is likely no data loss occurring.
Nonetheless, this patch is necessary to the goal of promoting this
warning out of W=1.

Link: https://github.com/ClangBuiltLinux/linux/issues/1902
Link: https://lore.kernel.org/llvm/202308081000.tTL1ElTr-lkp@intel.com/
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Justin Stitt <justinstitt@google.com>
Message-Id: <20230809-cbl-1902-v1-1-92def12d1dea@google.com>
Signed-off-by: Corey Minyard <minyard@acm.org>
ipmi: fix potential deadlock on &kcs_bmc->lock 2023-07-04T14:22:45+00:00 Chengfeng Ye dg573847474@gmail.com 2023-06-27T15:24:49+00:00 b02bb79eee074f07acdfde540f2d4fe2a04471d8 As kcs_bmc_handle_event() is executed inside both a timer and a hardirq, it should disable irq before lock acquisition otherwise deadlock could happen if the timmer is preemtped by the irq. Possible deadlock scenario: aspeed_kcs_check_obe() (timer) -> kcs_bmc_handle_event() -> spin_lock(&kcs_bmc->lock) <irq interruption> -> aspeed_kcs_irq() -> kcs_bmc_handle_event() -> spin_lock(&kcs_bmc->lock) (deadlock here) This flaw was found using an experimental static analysis tool we are developing for irq-related deadlock. The tentative patch fix the potential deadlock by spin_lock_irqsave() Signed-off-by: Chengfeng Ye <dg573847474@gmail.com> Message-Id: <20230627152449.36093-1-dg573847474@gmail.com> Signed-off-by: Corey Minyard <minyard@acm.org> 
As kcs_bmc_handle_event() is executed inside both a timer and a hardirq,
it should disable irq before lock acquisition otherwise deadlock could
happen if the timmer is preemtped by the irq.

Possible deadlock scenario:
aspeed_kcs_check_obe() (timer)
    -> kcs_bmc_handle_event()
    -> spin_lock(&kcs_bmc->lock)
        <irq interruption>
        -> aspeed_kcs_irq()
        -> kcs_bmc_handle_event()
        -> spin_lock(&kcs_bmc->lock) (deadlock here)

This flaw was found using an experimental static analysis tool we are
developing for irq-related deadlock.

The tentative patch fix the potential deadlock by spin_lock_irqsave()

Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Message-Id: <20230627152449.36093-1-dg573847474@gmail.com>
Signed-off-by: Corey Minyard <minyard@acm.org>
ipmi_si: fix a memleak in try_smi_init() 2023-06-29T13:06:45+00:00 Yi Yang yiyang13@huawei.com 2023-06-29T12:33:28+00:00 6cf1a126de2992b4efe1c3c4d398f8de4aed6e3f Kmemleak reported the following leak info in try_smi_init(): unreferenced object 0xffff00018ecf9400 (size 1024): comm "modprobe", pid 2707763, jiffies 4300851415 (age 773.308s) backtrace: [<000000004ca5b312>] __kmalloc+0x4b8/0x7b0 [<00000000953b1072>] try_smi_init+0x148/0x5dc [ipmi_si] [<000000006460d325>] 0xffff800081b10148 [<0000000039206ea5>] do_one_initcall+0x64/0x2a4 [<00000000601399ce>] do_init_module+0x50/0x300 [<000000003c12ba3c>] load_module+0x7a8/0x9e0 [<00000000c246fffe>] __se_sys_init_module+0x104/0x180 [<00000000eea99093>] __arm64_sys_init_module+0x24/0x30 [<0000000021b1ef87>] el0_svc_common.constprop.0+0x94/0x250 [<0000000070f4f8b7>] do_el0_svc+0x48/0xe0 [<000000005a05337f>] el0_svc+0x24/0x3c [<000000005eb248d6>] el0_sync_handler+0x160/0x164 [<0000000030a59039>] el0_sync+0x160/0x180 The problem was that when an error occurred before handlers registration and after allocating `new_smi->si_sm`, the variable wouldn't be freed in the error handling afterwards since `shutdown_smi()` hadn't been registered yet. Fix it by adding a `kfree()` in the error handling path in `try_smi_init()`. Cc: stable@vger.kernel.org # 4.19+ Fixes: 7960f18a5647 ("ipmi_si: Convert over to a shutdown handler") Signed-off-by: Yi Yang <yiyang13@huawei.com> Co-developed-by: GONG, Ruiqi <gongruiqi@huaweicloud.com> Signed-off-by: GONG, Ruiqi <gongruiqi@huaweicloud.com> Message-Id: <20230629123328.2402075-1-gongruiqi@huaweicloud.com> Signed-off-by: Corey Minyard <minyard@acm.org> 
Kmemleak reported the following leak info in try_smi_init():

unreferenced object 0xffff00018ecf9400 (size 1024):
  comm "modprobe", pid 2707763, jiffies 4300851415 (age 773.308s)
  backtrace:
    [<000000004ca5b312>] __kmalloc+0x4b8/0x7b0
    [<00000000953b1072>] try_smi_init+0x148/0x5dc [ipmi_si]
    [<000000006460d325>] 0xffff800081b10148
    [<0000000039206ea5>] do_one_initcall+0x64/0x2a4
    [<00000000601399ce>] do_init_module+0x50/0x300
    [<000000003c12ba3c>] load_module+0x7a8/0x9e0
    [<00000000c246fffe>] __se_sys_init_module+0x104/0x180
    [<00000000eea99093>] __arm64_sys_init_module+0x24/0x30
    [<0000000021b1ef87>] el0_svc_common.constprop.0+0x94/0x250
    [<0000000070f4f8b7>] do_el0_svc+0x48/0xe0
    [<000000005a05337f>] el0_svc+0x24/0x3c
    [<000000005eb248d6>] el0_sync_handler+0x160/0x164
    [<0000000030a59039>] el0_sync+0x160/0x180

The problem was that when an error occurred before handlers registration
and after allocating `new_smi->si_sm`, the variable wouldn't be freed in
the error handling afterwards since `shutdown_smi()` hadn't been
registered yet. Fix it by adding a `kfree()` in the error handling path
in `try_smi_init()`.

Cc: stable@vger.kernel.org # 4.19+
Fixes: 7960f18a5647 ("ipmi_si: Convert over to a shutdown handler")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Co-developed-by: GONG, Ruiqi <gongruiqi@huaweicloud.com>
Signed-off-by: GONG, Ruiqi <gongruiqi@huaweicloud.com>
Message-Id: <20230629123328.2402075-1-gongruiqi@huaweicloud.com>
Signed-off-by: Corey Minyard <minyard@acm.org>
ipmi: Change request_module to request_module_nowait 2023-06-20T14:59:53+00:00 Corey Minyard minyard@acm.org 2023-06-20T14:59:53+00:00 e87443a5f68da7bacefe933c90453ae7215263b3 When probing for an ACPI-specified IPMI device, the code would request that the acpi_ipmi module be loaded ACPI operations through IPMI can be performed. This could happen through module load context, for instance, if an I2C module is loaded that caused the IPMI interface to be probed. This is not allowed because a synchronous module load in this context can result in an deadlock, and I was getting a warning: [ 23.967853] WARNING: CPU: 0 PID: 21 at kernel/module/kmod.c:144 __request_module+0x1de/0x2d0 [ 23.968852] Modules linked in: i2c_i801 ipmi_ssif The IPMI driver is not dependent on acpi_ipmi, so just change the called to request_module_nowait to make the load asynchronous. Signed-off-by: Corey Minyard <minyard@acm.org> 
When probing for an ACPI-specified IPMI device, the code would request
that the acpi_ipmi module be loaded ACPI operations through IPMI can be
performed.  This could happen through module load context, for instance,
if an I2C module is loaded that caused the IPMI interface to be probed.

This is not allowed because a synchronous module load in this context
can result in an deadlock, and I was getting a warning:

[   23.967853] WARNING: CPU: 0 PID: 21 at kernel/module/kmod.c:144 __request_module+0x1de/0x2d0
[   23.968852] Modules linked in: i2c_i801 ipmi_ssif

The IPMI driver is not dependent on acpi_ipmi, so just change the called
to request_module_nowait to make the load asynchronous.

Signed-off-by: Corey Minyard <minyard@acm.org>
ipmi: make ipmi_class a static const structure 2023-06-20T14:49:08+00:00 Ivan Orlov ivan.orlov0322@gmail.com 2023-06-20T14:37:02+00:00 392fa3a3abdb03105c8767b7fb176bc8793349f5 Now that the driver core allows for struct class to be in read-only memory, move the ipmi_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at boot time. Cc: Corey Minyard <minyard@acm.org> Cc: openipmi-developer@lists.sourceforge.net Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Message-Id: <20230620143701.577657-2-gregkh@linuxfoundation.org> Signed-off-by: Corey Minyard <minyard@acm.org> 
Now that the driver core allows for struct class to be in read-only
memory, move the ipmi_class structure to be declared at build time
placing it into read-only memory, instead of having to be dynamically
allocated at boot time.

Cc: Corey Minyard <minyard@acm.org>
Cc: openipmi-developer@lists.sourceforge.net
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Message-Id: <20230620143701.577657-2-gregkh@linuxfoundation.org>
Signed-off-by: Corey Minyard <minyard@acm.org>