linux-stable.git/drivers/char, branch linux-4.17.y

ipmi: kcs_bmc: fix IRQ exception if the channel is not open

2018-08-24T11:06:49+00:00

[ Upstream commit dc0f0a026d33819bb82d5c26ab2fca838e2004be ]

When kcs_bmc_handle_event calls kcs_force_abort function to handle the
not open (no user running) KCS channel transaction, the returned status
value -ENODEV causes the low level IRQ handler indicating that the irq
was not for him by returning IRQ_NONE. After some time, this IRQ will
be treated to be spurious one, and the exception dump happens.

   irq 30: nobody cared (try booting with the "irqpoll" option)
   CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.10.15-npcm750 #1
   Hardware name: NPCMX50 Chip family
   [] (unwind_backtrace) from [] (show_stack+0x20/0x24)
   [] (show_stack) from [] (dump_stack+0x8c/0xa0)
   [] (dump_stack) from [] (__report_bad_irq+0x3c/0xdc)
   [] (__report_bad_irq) from [] (note_interrupt+0x29c/0x2ec)
   [] (note_interrupt) from [] (handle_irq_event_percpu+0x5c/0x68)
   [] (handle_irq_event_percpu) from [] (handle_irq_event+0x48/0x6c)
   [] (handle_irq_event) from [] (handle_fasteoi_irq+0xc8/0x198)
   [] (handle_fasteoi_irq) from [] (__handle_domain_irq+0x90/0xe8)
   [] (__handle_domain_irq) from [] (gic_handle_irq+0x58/0x9c)
   [] (gic_handle_irq) from [] (__irq_svc+0x6c/0x90)
   Exception stack(0xc0a01de8 to 0xc0a01e30)
   1de0:                   00002080 c0a6fbc0 00000000 00000000 00000000 c096d294
   1e00: 00000000 00000001 dc406400 f03ff100 00000082 c0a01e94 c0a6fbc0 c0a01e38
   1e20: 00200102 c01015bc 60000113 ffffffff
   [] (__irq_svc) from [] (__do_softirq+0xbc/0x358)
   [] (__do_softirq) from [] (irq_exit+0xb8/0xec)
   [] (irq_exit) from [] (__handle_domain_irq+0x94/0xe8)
   [] (__handle_domain_irq) from [] (gic_handle_irq+0x58/0x9c)
   [] (gic_handle_irq) from [] (__irq_svc+0x6c/0x90)
   Exception stack(0xc0a01ef8 to 0xc0a01f40)
   1ee0:                                                       00000000 000003ae
   1f00: dcc0f338 c0111060 c0a00000 c0a0cc44 c0a0cbe4 c0a1c22b c07bc218 00000001
   1f20: dcffca40 c0a01f54 c0a01f58 c0a01f48 c0103524 c0103528 60000013 ffffffff
   [] (__irq_svc) from [] (arch_cpu_idle+0x48/0x4c)
   [] (arch_cpu_idle) from [] (default_idle_call+0x30/0x3c)
   [] (default_idle_call) from [] (do_idle+0xc8/0x134)
   [] (do_idle) from [] (cpu_startup_entry+0x28/0x2c)
   [] (cpu_startup_entry) from [] (rest_init+0x84/0x88)
   [] (rest_init) from [] (start_kernel+0x388/0x394)
   [] (start_kernel) from [<0000807c>] (0x807c)
   handlers:
   [] npcm7xx_kcs_irq
   Disabling IRQ #30

It needs to change the returned status from -ENODEV to 0. The -ENODEV
was originally used to tell the low level IRQ handler that no user was
running, but not consider the IRQ handling desgin.

And multiple KCS channels share one IRQ handler, it needs to check the
IBF flag before doing force abort. If the IBF is set, after handling,
return 0 to low level IRQ handler to indicate that the IRQ is handled.

Signed-off-by: Haiyue Wang 
Signed-off-by: Corey Minyard 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

random: mix rdrand with entropy sent in from userspace

2018-08-03T05:48:03+00:00

commit 81e69df38e2911b642ec121dec319fad2a4782f3 upstream.

Fedora has integrated the jitter entropy daemon to work around slow
boot problems, especially on VM's that don't support virtio-rng:

    https://bugzilla.redhat.com/show_bug.cgi?id=1572944

It's understandable why they did this, but the Jitter entropy daemon
works fundamentally on the principle: "the CPU microarchitecture is
**so** complicated and we can't figure it out, so it *must* be
random".  Yes, it uses statistical tests to "prove" it is secure, but
AES_ENCRYPT(NSA_KEY, COUNTER++) will also pass statistical tests with
flying colors.

So if RDRAND is available, mix it into entropy submitted from
userspace.  It can't hurt, and if you believe the NSA has backdoored
RDRAND, then they probably have enough details about the Intel
microarchitecture that they can reverse engineer how the Jitter
entropy daemon affects the microarchitecture, and attack its output
stream.  And if RDRAND is in fact an honest DRNG, it will immeasurably
improve on what the Jitter entropy daemon might produce.

This also provides some protection against someone who is able to read
or set the entropy seed file.

Signed-off-by: Theodore Ts'o 
Cc: stable@vger.kernel.org
Cc: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

tpm: fix race condition in tpm_common_write()

2018-07-03T09:26:54+00:00

commit 3ab2011ea368ec3433ad49e1b9e1c7b70d2e65df upstream.

There is a race condition in tpm_common_write function allowing
two threads on the same /dev/tpm, or two different applications
on the same /dev/tpmrm to overwrite each other commands/responses.
Fixed this by taking the priv->buffer_mutex early in the function.

Also converted the priv->data_pending from atomic to a regular size_t
type. There is no need for it to be atomic since it is only touched
under the protection of the priv->buffer_mutex.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tadeusz Struk 
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Greg Kroah-Hartman

tpm: fix use after free in tpm2_load_context()

2018-07-03T09:26:54+00:00

commit 8c81c24758ffbf17cf06c6835d361ffa57be2f0e upstream.

If load context command returns with TPM2_RC_HANDLE or TPM2_RC_REFERENCE_H0
then we have use after free in line 114 and double free in 117.

Fixes: 4d57856a21ed2 ("tpm2: add session handle context saving and restoring to the space code")
Cc: stable@vger.kernel.org
Signed-off-by: Tadeusz Struk 
Reviewed-by: Jarkko Sakkinen 
Signed-off--by: Jarkko Sakkinen 
Signed-off-by: Greg Kroah-Hartman

hwrng: core - Always drop the RNG in hwrng_unregister()

2018-07-03T09:26:53+00:00

commit 837bf7cc3b7504385ae0e829c72e470dfc27cf6c upstream.

enable_best_rng() is used in hwrng_unregister() to switch away from the
currently active RNG, if that is the one currently being removed.
However enable_best_rng() might fail, if the next RNG's init routine
fails. In that case enable_best_rng() will return an error code and
the currently active RNG will remain active.
After unregistering this might lead to crashes due to use-after-free.

Fix this by dropping the currently active RNG, if enable_best_rng()
failed. This will result in no RNG to be active, if the next-best
one failed to initialize.

This problem was introduced by 142a27f0a731ddcf467546960a5585970ca98e21

Fixes: 142a27f0a731 ("hwrng: core - Reset user selected rng by...")
Reported-by: Wirz 
Tested-by: Wirz 
Signed-off-by: Michael Büsch 
Cc: stable@vger.kernel.org
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

ipmi:bt: Set the timeout before doing a capabilities check

2018-07-03T09:26:49+00:00

commit fe50a7d0393a552e4539da2d31261a59d6415950 upstream.

There was one place where the timeout value for an operation was
not being set, if a capabilities request was done from idle.  Move
the timeout value setting to before where that change might be
requested.

IMHO the cause here is the invisible returns in the macros.  Maybe
that's a job for later, though.

Reported-by: Nordmark Claes 
Signed-off-by: Corey Minyard 
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

agp: uninorth: make two functions static

2018-05-10T01:26:08+00:00

Both ‘uninorth_remove_memory’ and ‘null_cache_flush’ can be made
static. So make them.

Silence the following gcc warning (W=1):

  drivers/char/agp/uninorth-agp.c:198:5: warning: no previous prototype for ‘uninorth_remove_memory’ [-Wmissing-prototypes]

and

  drivers/char/agp/uninorth-agp.c:473:6: warning: no previous prototype for ‘null_cache_flush’ [-Wmissing-prototypes]

Signed-off-by: Mathieu Malaterre 
Signed-off-by: Dave Airlie

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

2018-04-26T23:36:11+00:00

Pull virtio fixups from Michael Tsirkin:

 - Latest header update will break QEMU (if it's rebuilt with the new
   header) - and it seems that the code there is so fragile that any
   change in this header will break it. Add a better interface so users
   do not need to change their code every time that header changes.

 - Fix virtio console for spec compliance.

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  virtio_console: reset on out of memory
  virtio_console: move removal code
  virtio_console: drop custom control queue cleanup
  virtio_console: free buffers after reset
  virtio: add ability to iterate over vqs
  virtio_console: don't tie bufs to a vq
  virtio_balloon: add array of stat names

Merge tag 'random_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random

2018-04-26T17:59:56+00:00

Pull /dev/random fixes from Ted Ts'o:
 "Fix a regression on NUMA kernels and suppress excess unseeded entropy
  pool warnings"

* tag 'random_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random:
  random: rate limit unseeded randomness warnings
  random: fix possible sleeping allocation from irq context

virtio_console: reset on out of memory

2018-04-25T17:41:29+00:00

When out of memory and we can't add ctrl vq buffers,
probe fails. Unfortunately the error handling is
out of spec: it calls del_vqs without bothering
to reset the device first.

To fix, call the full cleanup function in this case.

Cc: stable@vger.kernel.org
Signed-off-by: Michael S. Tsirkin