| Message ID | 20141031063233.1884.86309.stgit@bahia.local (mailing list archive) |
|---|---|
| State | Awaiting Upstream, archived |
| Headers | show |
On Fri, 2014-10-31 at 07:50 +0100, Greg Kurz wrote: > The add_early_randomness() function in drivers/char/hw_random/core.c passes > a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall() > returns four 64-bit values and trashes 16 bytes on the stack. Hmm, thanks. I thought I'd fixed that, but I guess I never sent the patch :} > This bug has been lying around for a long time. It got unveiled by: > > commit d3cc7996473a7bdd33256029988ea690754e4e2a > Author: Amit Shah <amit.shah@redhat.com> > Date: Thu Jul 10 15:42:34 2014 +0530 > > hwrng: fetch randomness only after device init > > It may trig a oops while loading or unloading the pseries-rng module for both > PowerVM and PowerKVM guests. > > This patch does two things: > - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe > since we're not on a hot path. Well probably, can you do a before and after test of dd if=/dev/hwrng ? > Cc'ing stable as I could reproduce back to 3.15.10 The right way to CC stable for a patch that isn't yet in upstream is to add: CC: stable@vger.kernel.org Before your Signed-off-by. They will then pick it up once it's merged into Linus' tree. See Documentation/stable_kernel_rules.txt cheers
On Fri, 31 Oct 2014 18:00:12 +1100 Michael Ellerman <mpe@ellerman.id.au> wrote: > On Fri, 2014-10-31 at 07:50 +0100, Greg Kurz wrote: > > The add_early_randomness() function in drivers/char/hw_random/core.c passes > > a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall() > > returns four 64-bit values and trashes 16 bytes on the stack. > > Hmm, thanks. I thought I'd fixed that, but I guess I never sent the patch :} > Heh so many patches ! :) > > This bug has been lying around for a long time. It got unveiled by: > > > > commit d3cc7996473a7bdd33256029988ea690754e4e2a > > Author: Amit Shah <amit.shah@redhat.com> > > Date: Thu Jul 10 15:42:34 2014 +0530 > > > > hwrng: fetch randomness only after device init > > > > It may trig a oops while loading or unloading the pseries-rng module for both > > PowerVM and PowerKVM guests. > > > > This patch does two things: > > - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe > > since we're not on a hot path. > > Well probably, can you do a before and after test of dd if=/dev/hwrng ? > I had to do this to be able to run the before test: @@ -78,7 +78,7 @@ static size_t rng_buffer_size(void) static void add_early_randomness(struct hwrng *rng) { - unsigned char bytes[16]; + unsigned char bytes[32]; I ran tests for 128 MB and 1G several times in a PowerKVM guest on a POWER8 box. Before: [root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024 count=131072 131072+0 records in 131072+0 records out 134217728 bytes (134 MB) copied, 17.0503 s, 7.9 MB/s real 0m17.051s user 0m0.024s sys 0m16.797s [root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024 count=1048576 1048576+0 records in 1048576+0 records out 1073741824 bytes (1.1 GB) copied, 136.374 s, 7.9 MB/s real 2m16.376s user 0m0.189s sys 2m14.367s After: [root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024 count=131072 131072+0 records in 131072+0 records out 134217728 bytes (134 MB) copied, 17.0502 s, 7.9 MB/s real 0m17.051s user 0m0.024s sys 0m16.797s [root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024 count=1048576 1048576+0 records in 1048576+0 records out 1073741824 bytes (1.1 GB) copied, 136.432 s, 7.9 MB/s real 2m16.433s user 0m0.188s sys 2m14.370s It shows no degradation of performance. > > Cc'ing stable as I could reproduce back to 3.15.10 > > The right way to CC stable for a patch that isn't yet in upstream is to add: > > CC: stable@vger.kernel.org > > Before your Signed-off-by. They will then pick it up once it's merged into > Linus' tree. See Documentation/stable_kernel_rules.txt > > cheers > Oops... should I repost then ? Thanks. -- Greg
On Fri, Oct 31, 2014 at 10:31:41AM +0100, Greg Kurz wrote: > > > > Cc'ing stable as I could reproduce back to 3.15.10 > > > > The right way to CC stable for a patch that isn't yet in upstream is to add: > > > > CC: stable@vger.kernel.org > > > > Before your Signed-off-by. They will then pick it up once it's merged into > > Linus' tree. See Documentation/stable_kernel_rules.txt > > > > cheers > > > > Oops... should I repost then ? Don't worry, I can fix this up. Cheers,
On Fri, Oct 31, 2014 at 07:50:11AM +0100, Greg Kurz wrote: > The add_early_randomness() function in drivers/char/hw_random/core.c passes > a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall() > returns four 64-bit values and trashes 16 bytes on the stack. > > This bug has been lying around for a long time. It got unveiled by: > > commit d3cc7996473a7bdd33256029988ea690754e4e2a > Author: Amit Shah <amit.shah@redhat.com> > Date: Thu Jul 10 15:42:34 2014 +0530 > > hwrng: fetch randomness only after device init > > It may trig a oops while loading or unloading the pseries-rng module for both > PowerVM and PowerKVM guests. > > This patch does two things: > - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe > since we're not on a hot path. > - move to the new read API so that we know the return buffer size for sure. > > Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Patch applied to crypto. Thanks,
diff --git a/drivers/char/hw_random/pseries-rng.c b/drivers/char/hw_random/pseries-rng.c index 6226aa0..bcf86f9 100644 --- a/drivers/char/hw_random/pseries-rng.c +++ b/drivers/char/hw_random/pseries-rng.c @@ -25,18 +25,21 @@ #include <asm/vio.h> -static int pseries_rng_data_read(struct hwrng *rng, u32 *data) +static int pseries_rng_read(struct hwrng *rng, void *data, size_t max, bool wait) { + u64 buffer[PLPAR_HCALL_BUFSIZE]; + size_t size = max < 8 ? max : 8; int rc; - rc = plpar_hcall(H_RANDOM, (unsigned long *)data); + rc = plpar_hcall(H_RANDOM, (unsigned long *)buffer); if (rc != H_SUCCESS) { pr_err_ratelimited("H_RANDOM call failed %d\n", rc); return -EIO; } + memcpy(data, buffer, size); /* The hypervisor interface returns 64 bits */ - return 8; + return size; } /** @@ -55,7 +58,7 @@ static unsigned long pseries_rng_get_desired_dma(struct vio_dev *vdev) static struct hwrng pseries_rng = { .name = KBUILD_MODNAME, - .data_read = pseries_rng_data_read, + .read = pseries_rng_read, }; static int __init pseries_rng_probe(struct vio_dev *dev,
The add_early_randomness() function in drivers/char/hw_random/core.c passes a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall() returns four 64-bit values and trashes 16 bytes on the stack. This bug has been lying around for a long time. It got unveiled by: commit d3cc7996473a7bdd33256029988ea690754e4e2a Author: Amit Shah <amit.shah@redhat.com> Date: Thu Jul 10 15:42:34 2014 +0530 hwrng: fetch randomness only after device init It may trig a oops while loading or unloading the pseries-rng module for both PowerVM and PowerKVM guests. This patch does two things: - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe since we're not on a hot path. - move to the new read API so that we know the return buffer size for sure. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> --- Cc'ing stable as I could reproduce back to 3.15.10 drivers/char/hw_random/pseries-rng.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)