[PATCH] hwrng: pseries - port to new read API and fix stack corruption

[PATCH] hwrng: pseries - port to new read API and fix stack corruption

[Greg Kurz]

The add_early_randomness() function in drivers/char/hw_random/core.c passes
a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
returns four 64-bit values and trashes 16 bytes on the stack.

This bug has been lying around for a long time. It got unveiled by:

commit d3cc7996473a7bdd33256029988ea690754e4e2a
Author: Amit Shah <amit.shah@redhat.com>
Date:   Thu Jul 10 15:42:34 2014 +0530

    hwrng: fetch randomness only after device init

It may trig a oops while loading or unloading the pseries-rng module for both
PowerVM and PowerKVM guests.

This patch does two things:
- pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
  since we're not on a hot path.
- move to the new read API so that we know the return buffer size for sure.

Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
---

Cc'ing stable as I could reproduce back to 3.15.10

 drivers/char/hw_random/pseries-rng.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/char/hw_random/pseries-rng.c b/drivers/char/hw_random/pseries-rng.c
index 6226aa0..bcf86f9 100644
--- a/drivers/char/hw_random/pseries-rng.c
+++ b/drivers/char/hw_random/pseries-rng.c
@@ -25,18 +25,21 @@
 #include <asm/vio.h>
 
 
-static int pseries_rng_data_read(struct hwrng *rng, u32 *data)
+static int pseries_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
 {
+	u64 buffer[PLPAR_HCALL_BUFSIZE];
+	size_t size = max < 8 ? max : 8;
 	int rc;
 
-	rc = plpar_hcall(H_RANDOM, (unsigned long *)data);
+	rc = plpar_hcall(H_RANDOM, (unsigned long *)buffer);
 	if (rc != H_SUCCESS) {
 		pr_err_ratelimited("H_RANDOM call failed %d\n", rc);
 		return -EIO;
 	}
+	memcpy(data, buffer, size);
 
 	/* The hypervisor interface returns 64 bits */
-	return 8;
+	return size;
 }
 
 /**
@@ -55,7 +58,7 @@ static unsigned long pseries_rng_get_desired_dma(struct vio_dev *vdev)
 
 static struct hwrng pseries_rng = {
 	.name		= KBUILD_MODNAME,
-	.data_read	= pseries_rng_data_read,
+	.read		= pseries_rng_read,
 };
 
 static int __init pseries_rng_probe(struct vio_dev *dev,

[PATCH] hwrng: pseries - port to new read API and fix stack corruption

[Greg Kurz]

The add_early_randomness() function in drivers/char/hw_random/core.c passes
a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
returns four 64-bit values and trashes 16 bytes on the stack.

This bug has been lying around for a long time. It got unveiled by:

commit d3cc7996473a7bdd33256029988ea690754e4e2a
Author: Amit Shah <amit.shah@redhat.com>
Date:   Thu Jul 10 15:42:34 2014 +0530

    hwrng: fetch randomness only after device init

It may trig a oops while loading or unloading the pseries-rng module for both
PowerVM and PowerKVM guests.

This patch does two things:
- pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
  since we're not on a hot path.
- move to the new read API so that we know the return buffer size for sure.

Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
---

Cc'ing stable as I could reproduce back to 3.15.10

 drivers/char/hw_random/pseries-rng.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/char/hw_random/pseries-rng.c b/drivers/char/hw_random/pseries-rng.c
index 6226aa0..bcf86f9 100644
--- a/drivers/char/hw_random/pseries-rng.c
+++ b/drivers/char/hw_random/pseries-rng.c
@@ -25,18 +25,21 @@
 #include <asm/vio.h>
 
 
-static int pseries_rng_data_read(struct hwrng *rng, u32 *data)
+static int pseries_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
 {
+	u64 buffer[PLPAR_HCALL_BUFSIZE];
+	size_t size = max < 8 ? max : 8;
 	int rc;
 
-	rc = plpar_hcall(H_RANDOM, (unsigned long *)data);
+	rc = plpar_hcall(H_RANDOM, (unsigned long *)buffer);
 	if (rc != H_SUCCESS) {
 		pr_err_ratelimited("H_RANDOM call failed %d\n", rc);
 		return -EIO;
 	}
+	memcpy(data, buffer, size);
 
 	/* The hypervisor interface returns 64 bits */
-	return 8;
+	return size;
 }
 
 /**
@@ -55,7 +58,7 @@ static unsigned long pseries_rng_get_desired_dma(struct vio_dev *vdev)
 
 static struct hwrng pseries_rng = {
 	.name		= KBUILD_MODNAME,
-	.data_read	= pseries_rng_data_read,
+	.read		= pseries_rng_read,
 };
 
 static int __init pseries_rng_probe(struct vio_dev *dev,

Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption

[Michael Ellerman]

On Fri, 2014-10-31 at 07:50 +0100, Greg Kurz wrote:
> The add_early_randomness() function in drivers/char/hw_random/core.c passes
> a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
> returns four 64-bit values and trashes 16 bytes on the stack.

Hmm, thanks. I thought I'd fixed that, but I guess I never sent the patch :}

> This bug has been lying around for a long time. It got unveiled by:
> 
> commit d3cc7996473a7bdd33256029988ea690754e4e2a
> Author: Amit Shah <amit.shah@redhat.com>
> Date:   Thu Jul 10 15:42:34 2014 +0530
> 
>     hwrng: fetch randomness only after device init
> 
> It may trig a oops while loading or unloading the pseries-rng module for both
> PowerVM and PowerKVM guests.
> 
> This patch does two things:
> - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
>   since we're not on a hot path.

Well probably, can you do a before and after test of dd if=/dev/hwrng ?

> Cc'ing stable as I could reproduce back to 3.15.10

The right way to CC stable for a patch that isn't yet in upstream is to add:

CC: stable@vger.kernel.org

Before your Signed-off-by. They will then pick it up once it's merged into
Linus' tree. See Documentation/stable_kernel_rules.txt

cheers

Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption

[Michael Ellerman]

On Fri, 2014-10-31 at 07:50 +0100, Greg Kurz wrote:
> The add_early_randomness() function in drivers/char/hw_random/core.c passes
> a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
> returns four 64-bit values and trashes 16 bytes on the stack.

Hmm, thanks. I thought I'd fixed that, but I guess I never sent the patch :}

> This bug has been lying around for a long time. It got unveiled by:
> 
> commit d3cc7996473a7bdd33256029988ea690754e4e2a
> Author: Amit Shah <amit.shah@redhat.com>
> Date:   Thu Jul 10 15:42:34 2014 +0530
> 
>     hwrng: fetch randomness only after device init
> 
> It may trig a oops while loading or unloading the pseries-rng module for both
> PowerVM and PowerKVM guests.
> 
> This patch does two things:
> - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
>   since we're not on a hot path.

Well probably, can you do a before and after test of dd if=/dev/hwrng ?

> Cc'ing stable as I could reproduce back to 3.15.10

The right way to CC stable for a patch that isn't yet in upstream is to add:

CC: stable@vger.kernel.org

Before your Signed-off-by. They will then pick it up once it's merged into
Linus' tree. See Documentation/stable_kernel_rules.txt

cheers

Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption

[Greg Kurz]

On Fri, 31 Oct 2014 18:00:12 +1100
Michael Ellerman <mpe@ellerman.id.au> wrote:

> On Fri, 2014-10-31 at 07:50 +0100, Greg Kurz wrote:
> > The add_early_randomness() function in drivers/char/hw_random/core.c passes
> > a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
> > returns four 64-bit values and trashes 16 bytes on the stack.
> 
> Hmm, thanks. I thought I'd fixed that, but I guess I never sent the patch :}
> 

Heh so many patches ! :)

> > This bug has been lying around for a long time. It got unveiled by:
> > 
> > commit d3cc7996473a7bdd33256029988ea690754e4e2a
> > Author: Amit Shah <amit.shah@redhat.com>
> > Date:   Thu Jul 10 15:42:34 2014 +0530
> > 
> >     hwrng: fetch randomness only after device init
> > 
> > It may trig a oops while loading or unloading the pseries-rng module for both
> > PowerVM and PowerKVM guests.
> > 
> > This patch does two things:
> > - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
> >   since we're not on a hot path.
> 
> Well probably, can you do a before and after test of dd if=/dev/hwrng ?
> 

I had to do this to be able to run the before test:

@@ -78,7 +78,7 @@ static size_t rng_buffer_size(void)
 
 static void add_early_randomness(struct hwrng *rng)
 {
-       unsigned char bytes[16];
+       unsigned char bytes[32];

I ran tests for 128 MB and 1G several times in a PowerKVM guest on a POWER8 box.

Before:

[root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024 count=131072
131072+0 records in
131072+0 records out
134217728 bytes (134 MB) copied, 17.0503 s, 7.9 MB/s

real    0m17.051s
user    0m0.024s
sys     0m16.797s
[root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024 count=1048576
1048576+0 records in
1048576+0 records out
1073741824 bytes (1.1 GB) copied, 136.374 s, 7.9 MB/s

real    2m16.376s
user    0m0.189s
sys     2m14.367s

After:

[root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024 count=131072
131072+0 records in
131072+0 records out
134217728 bytes (134 MB) copied, 17.0502 s, 7.9 MB/s

real    0m17.051s
user    0m0.024s
sys     0m16.797s
[root@fedora20-ppc64 ~]# time dd if=/dev/hwrng of=/dev/null bs=1024 count=1048576
1048576+0 records in
1048576+0 records out
1073741824 bytes (1.1 GB) copied, 136.432 s, 7.9 MB/s

real    2m16.433s
user    0m0.188s
sys     2m14.370s

It shows no degradation of performance.

> > Cc'ing stable as I could reproduce back to 3.15.10
> 
> The right way to CC stable for a patch that isn't yet in upstream is to add:
> 
> CC: stable@vger.kernel.org
> 
> Before your Signed-off-by. They will then pick it up once it's merged into
> Linus' tree. See Documentation/stable_kernel_rules.txt
> 
> cheers
> 

Oops... should I repost then ?

Thanks.

--
Greg

Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption

[Herbert Xu]

On Fri, Oct 31, 2014 at 10:31:41AM +0100, Greg Kurz wrote:
>
> > > Cc'ing stable as I could reproduce back to 3.15.10
> > 
> > The right way to CC stable for a patch that isn't yet in upstream is to add:
> > 
> > CC: stable@vger.kernel.org
> > 
> > Before your Signed-off-by. They will then pick it up once it's merged into
> > Linus' tree. See Documentation/stable_kernel_rules.txt
> > 
> > cheers
> > 
> 
> Oops... should I repost then ?

Don't worry, I can fix this up.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption

[Herbert Xu]

On Fri, Oct 31, 2014 at 10:31:41AM +0100, Greg Kurz wrote:
>
> > > Cc'ing stable as I could reproduce back to 3.15.10
> > 
> > The right way to CC stable for a patch that isn't yet in upstream is to add:
> > 
> > CC: stable@vger.kernel.org
> > 
> > Before your Signed-off-by. They will then pick it up once it's merged into
> > Linus' tree. See Documentation/stable_kernel_rules.txt
> > 
> > cheers
> > 
> 
> Oops... should I repost then ?

Don't worry, I can fix this up.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption

[Herbert Xu]

On Fri, Oct 31, 2014 at 07:50:11AM +0100, Greg Kurz wrote:
> The add_early_randomness() function in drivers/char/hw_random/core.c passes
> a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
> returns four 64-bit values and trashes 16 bytes on the stack.
> 
> This bug has been lying around for a long time. It got unveiled by:
> 
> commit d3cc7996473a7bdd33256029988ea690754e4e2a
> Author: Amit Shah <amit.shah@redhat.com>
> Date:   Thu Jul 10 15:42:34 2014 +0530
> 
>     hwrng: fetch randomness only after device init
> 
> It may trig a oops while loading or unloading the pseries-rng module for both
> PowerVM and PowerKVM guests.
> 
> This patch does two things:
> - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
>   since we're not on a hot path.
> - move to the new read API so that we know the return buffer size for sure.
> 
> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>

Patch applied to crypto.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption

[Herbert Xu]

On Fri, Oct 31, 2014 at 07:50:11AM +0100, Greg Kurz wrote:
> The add_early_randomness() function in drivers/char/hw_random/core.c passes
> a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
> returns four 64-bit values and trashes 16 bytes on the stack.
> 
> This bug has been lying around for a long time. It got unveiled by:
> 
> commit d3cc7996473a7bdd33256029988ea690754e4e2a
> Author: Amit Shah <amit.shah@redhat.com>
> Date:   Thu Jul 10 15:42:34 2014 +0530
> 
>     hwrng: fetch randomness only after device init
> 
> It may trig a oops while loading or unloading the pseries-rng module for both
> PowerVM and PowerKVM guests.
> 
> This patch does two things:
> - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
>   since we're not on a hot path.
> - move to the new read API so that we know the return buffer size for sure.
> 
> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>

Patch applied to crypto.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt