Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption
On Fri, Oct 31, 2014 at 07:50:11AM +0100, Greg Kurz wrote: The add_early_randomness() function in drivers/char/hw_random/core.c passes a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall() returns four 64-bit values and trashes 16 bytes on the stack. This bug has been lying around for a long time. It got unveiled by: commit d3cc7996473a7bdd33256029988ea690754e4e2a Author: Amit Shah amit.s...@redhat.com Date: Thu Jul 10 15:42:34 2014 +0530 hwrng: fetch randomness only after device init It may trig a oops while loading or unloading the pseries-rng module for both PowerVM and PowerKVM guests. This patch does two things: - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe since we're not on a hot path. - move to the new read API so that we know the return buffer size for sure. Signed-off-by: Greg Kurz gk...@linux.vnet.ibm.com Patch applied to crypto. Thanks, -- Email: Herbert Xu herb...@gondor.apana.org.au Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt ___ Linuxppc-dev mailing list Linuxppc-dev@lists.ozlabs.org https://lists.ozlabs.org/listinfo/linuxppc-dev
[PATCH] hwrng: pseries - port to new read API and fix stack corruption
The add_early_randomness() function in drivers/char/hw_random/core.c passes
a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
returns four 64-bit values and trashes 16 bytes on the stack.
This bug has been lying around for a long time. It got unveiled by:
commit d3cc7996473a7bdd33256029988ea690754e4e2a
Author: Amit Shah amit.s...@redhat.com
Date: Thu Jul 10 15:42:34 2014 +0530
hwrng: fetch randomness only after device init
It may trig a oops while loading or unloading the pseries-rng module for both
PowerVM and PowerKVM guests.
This patch does two things:
- pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
since we're not on a hot path.
- move to the new read API so that we know the return buffer size for sure.
Signed-off-by: Greg Kurz gk...@linux.vnet.ibm.com
---
Cc'ing stable as I could reproduce back to 3.15.10
drivers/char/hw_random/pseries-rng.c | 11 +++
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/char/hw_random/pseries-rng.c
b/drivers/char/hw_random/pseries-rng.c
index 6226aa0..bcf86f9 100644
--- a/drivers/char/hw_random/pseries-rng.c
+++ b/drivers/char/hw_random/pseries-rng.c
@@ -25,18 +25,21 @@
#include asm/vio.h
-static int pseries_rng_data_read(struct hwrng *rng, u32 *data)
+static int pseries_rng_read(struct hwrng *rng, void *data, size_t max, bool
wait)
{
+ u64 buffer[PLPAR_HCALL_BUFSIZE];
+ size_t size = max 8 ? max : 8;
int rc;
- rc = plpar_hcall(H_RANDOM, (unsigned long *)data);
+ rc = plpar_hcall(H_RANDOM, (unsigned long *)buffer);
if (rc != H_SUCCESS) {
pr_err_ratelimited(H_RANDOM call failed %d\n, rc);
return -EIO;
}
+ memcpy(data, buffer, size);
/* The hypervisor interface returns 64 bits */
- return 8;
+ return size;
}
/**
@@ -55,7 +58,7 @@ static unsigned long pseries_rng_get_desired_dma(struct
vio_dev *vdev)
static struct hwrng pseries_rng = {
.name = KBUILD_MODNAME,
- .data_read = pseries_rng_data_read,
+ .read = pseries_rng_read,
};
static int __init pseries_rng_probe(struct vio_dev *dev,
___
Linuxppc-dev mailing list
Linuxppc-dev@lists.ozlabs.org
https://lists.ozlabs.org/listinfo/linuxppc-dev
Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption
On Fri, 2014-10-31 at 07:50 +0100, Greg Kurz wrote: The add_early_randomness() function in drivers/char/hw_random/core.c passes a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall() returns four 64-bit values and trashes 16 bytes on the stack. Hmm, thanks. I thought I'd fixed that, but I guess I never sent the patch :} This bug has been lying around for a long time. It got unveiled by: commit d3cc7996473a7bdd33256029988ea690754e4e2a Author: Amit Shah amit.s...@redhat.com Date: Thu Jul 10 15:42:34 2014 +0530 hwrng: fetch randomness only after device init It may trig a oops while loading or unloading the pseries-rng module for both PowerVM and PowerKVM guests. This patch does two things: - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe since we're not on a hot path. Well probably, can you do a before and after test of dd if=/dev/hwrng ? Cc'ing stable as I could reproduce back to 3.15.10 The right way to CC stable for a patch that isn't yet in upstream is to add: CC: sta...@vger.kernel.org Before your Signed-off-by. They will then pick it up once it's merged into Linus' tree. See Documentation/stable_kernel_rules.txt cheers ___ Linuxppc-dev mailing list Linuxppc-dev@lists.ozlabs.org https://lists.ozlabs.org/listinfo/linuxppc-dev
Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption
On Fri, 31 Oct 2014 18:00:12 +1100
Michael Ellerman m...@ellerman.id.au wrote:
On Fri, 2014-10-31 at 07:50 +0100, Greg Kurz wrote:
The add_early_randomness() function in drivers/char/hw_random/core.c passes
a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
returns four 64-bit values and trashes 16 bytes on the stack.
Hmm, thanks. I thought I'd fixed that, but I guess I never sent the patch :}
Heh so many patches ! :)
This bug has been lying around for a long time. It got unveiled by:
commit d3cc7996473a7bdd33256029988ea690754e4e2a
Author: Amit Shah amit.s...@redhat.com
Date: Thu Jul 10 15:42:34 2014 +0530
hwrng: fetch randomness only after device init
It may trig a oops while loading or unloading the pseries-rng module for
both
PowerVM and PowerKVM guests.
This patch does two things:
- pass an intermediate well sized buffer to plpar_hcall(). This is
acceptalbe
since we're not on a hot path.
Well probably, can you do a before and after test of dd if=/dev/hwrng ?
I had to do this to be able to run the before test:
@@ -78,7 +78,7 @@ static size_t rng_buffer_size(void)
static void add_early_randomness(struct hwrng *rng)
{
- unsigned char bytes[16];
+ unsigned char bytes[32];
I ran tests for 128 MB and 1G several times in a PowerKVM guest on a POWER8 box.
Before:
[root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024 count=131072
131072+0 records in
131072+0 records out
134217728 bytes (134 MB) copied, 17.0503 s, 7.9 MB/s
real0m17.051s
user0m0.024s
sys 0m16.797s
[root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024
count=1048576
1048576+0 records in
1048576+0 records out
1073741824 bytes (1.1 GB) copied, 136.374 s, 7.9 MB/s
real2m16.376s
user0m0.189s
sys 2m14.367s
After:
[root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024 count=131072
131072+0 records in
131072+0 records out
134217728 bytes (134 MB) copied, 17.0502 s, 7.9 MB/s
real0m17.051s
user0m0.024s
sys 0m16.797s
[root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024
count=1048576
1048576+0 records in
1048576+0 records out
1073741824 bytes (1.1 GB) copied, 136.432 s, 7.9 MB/s
real2m16.433s
user0m0.188s
sys 2m14.370s
It shows no degradation of performance.
Cc'ing stable as I could reproduce back to 3.15.10
The right way to CC stable for a patch that isn't yet in upstream is to add:
CC: sta...@vger.kernel.org
Before your Signed-off-by. They will then pick it up once it's merged into
Linus' tree. See Documentation/stable_kernel_rules.txt
cheers
Oops... should I repost then ?
Thanks.
--
Greg
___
Linuxppc-dev mailing list
Linuxppc-dev@lists.ozlabs.org
https://lists.ozlabs.org/listinfo/linuxppc-dev
Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption
On Fri, Oct 31, 2014 at 10:31:41AM +0100, Greg Kurz wrote: Cc'ing stable as I could reproduce back to 3.15.10 The right way to CC stable for a patch that isn't yet in upstream is to add: CC: sta...@vger.kernel.org Before your Signed-off-by. They will then pick it up once it's merged into Linus' tree. See Documentation/stable_kernel_rules.txt cheers Oops... should I repost then ? Don't worry, I can fix this up. Cheers, -- Email: Herbert Xu herb...@gondor.apana.org.au Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt ___ Linuxppc-dev mailing list Linuxppc-dev@lists.ozlabs.org https://lists.ozlabs.org/listinfo/linuxppc-dev
