* [PATCH] rtas: Validate rtas entry before calling enter_rtas
@ 2015-10-16 10:23 Vasant Hegde
2015-10-16 10:32 ` Denis Kirjanov
0 siblings, 1 reply; 6+ messages in thread
From: Vasant Hegde @ 2015-10-16 10:23 UTC (permalink / raw)
To: linuxppc-dev; +Cc: mpe, ego
Currently we do not validate rtas entry before calling enter_rtas(). This
is resulting in a kernel oops (see below) when user space calls rtas system
call on PowerNV platform. We hit below oops when we ran trinity (system call
fuzzer) on PowerNV. This patch adds code to validate rtas entry before making
enter_rtas() call.
dmesg:
-----
[22061.541428] Oops: Exception in kernel mode, sig: 4 [#1]
[22061.541446] SMP NR_CPUS=1024 NUMA PowerNV
[22061.541453] Modules linked in: rfcomm bnep nfnetlink scsi_transport_iscsi hidp nfc af_802154 ieee802154 bluetooth rfkill pppoe pppox ppp_generic slhc irda crc_ccitt af_key sctp libcrc32c atm appletalk ipx p8023 psnap p8022 ipt_MASQUERADE nf_nat_masquerade_ipv4 xt_CHECKSUM tun ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw windfarm_smu_sat ses enclosure windfarm_pid shpchp i2c_opal i2c_core kvm_hv kvm_pr dm_multipath kvm lpfc tg3 ptp pps_core scsi_transport_fc
[22061.541561] CPU: 40 PID: 57748 Comm: trinity-c11 Not tainted 3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le #1
[22061.541566] task: c000000004294b80 ti: c0000007e1a78000 task.ti: c0000007e1a78000
[22061.541570] NIP: 0000000000000000 LR: 0000000000009c14 CTR: c000000000423140
[22061.541573] REGS: c0000007e1a7b920 TRAP: 0e40 Not tainted (3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le)
[22061.541577] MSR: 1000000000081000 <HV,ME> CR: 00000000 XER: 00000000
[22061.541585] CFAR: c000000000009c0c SOFTE: 0
GPR00: 9000000000001031 c0000007e1a7bba0 c0000000012b1d00 0000000001338840
GPR04: 0000000000000000 0000000000000000 1000000000001000 9000000000001033
GPR08: 0000000040000000 8000000000002933 00003fff9e9d0068 0000000000000000
GPR12: 00000000000000ff c000000007db7c00 0000000000000000 0000000000000000
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR24: 0000000000000000 000000000000dc58 0000000000000001 c000001ee716e000
GPR28: 0000000000000000 c000000001338840 00003fff9db30000 0000000000000000
[22061.541629] NIP [0000000000000000] (null)
[22061.541637] LR [0000000000009c14] 0x9c14
[22061.541640] Call Trace:
[22061.541649] [c0000007e1a7bba0] [c00000000041a7f4] avc_has_perm_noaudit+0x54/0x110 (unreliable)
[22061.541657] [c0000007e1a7bd80] [c00000000002ddc0] ppc_rtas+0x150/0x2d0
[22061.541662] [c0000007e1a7be30] [c000000000009358] syscall_exit+0x0/0x98
[22061.541666] Instruction dump:
[22061.541669] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
[22061.541675] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX 60000000 60000000 60000000 60000000
[22061.541688] ---[ end trace 6f9bf0b3d32096aa ]---
Reported-by: NAGESWARA R. SASTRY <nasastry@in.ibm.com>
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
---
arch/powerpc/kernel/rtas.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 84bf934..5a753fa 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -1043,6 +1043,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs)
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
+ if (!rtas.entry)
+ return -EINVAL;
+
if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
return -EFAULT;
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] rtas: Validate rtas entry before calling enter_rtas
2015-10-16 10:23 [PATCH] rtas: Validate rtas entry before calling enter_rtas Vasant Hegde
@ 2015-10-16 10:32 ` Denis Kirjanov
2015-10-16 15:14 ` Vasant Hegde
0 siblings, 1 reply; 6+ messages in thread
From: Denis Kirjanov @ 2015-10-16 10:32 UTC (permalink / raw)
To: Vasant Hegde; +Cc: linuxppc-dev, ego
On 10/16/15, Vasant Hegde <hegdevasant@linux.vnet.ibm.com> wrote:
> Currently we do not validate rtas entry before calling enter_rtas(). This
> is resulting in a kernel oops (see below) when user space calls rtas system
> call on PowerNV platform. We hit below oops when we ran trinity (system call
> fuzzer) on PowerNV. This patch adds code to validate rtas entry before
> making
> enter_rtas() call.
Hi,
have you figured out why we have null entry?
Thanks!
>
> dmesg:
> -----
> [22061.541428] Oops: Exception in kernel mode, sig: 4 [#1]
> [22061.541446] SMP NR_CPUS=1024 NUMA PowerNV
> [22061.541453] Modules linked in: rfcomm bnep nfnetlink scsi_transport_iscsi
> hidp nfc af_802154 ieee802154 bluetooth rfkill pppoe pppox ppp_generic slhc
> irda crc_ccitt af_key sctp libcrc32c atm appletalk ipx p8023 psnap p8022
> ipt_MASQUERADE nf_nat_masquerade_ipv4 xt_CHECKSUM tun ip6t_rpfilter
> ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack
> ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
> ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables
> iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack
> iptable_mangle iptable_security iptable_raw windfarm_smu_sat ses enclosure
> windfarm_pid shpchp i2c_opal i2c_core kvm_hv kvm_pr dm_multipath kvm lpfc
> tg3 ptp pps_core scsi_transport_fc
> [22061.541561] CPU: 40 PID: 57748 Comm: trinity-c11 Not tainted
> 3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le #1
> [22061.541566] task: c000000004294b80 ti: c0000007e1a78000 task.ti:
> c0000007e1a78000
> [22061.541570] NIP: 0000000000000000 LR: 0000000000009c14 CTR:
> c000000000423140
> [22061.541573] REGS: c0000007e1a7b920 TRAP: 0e40 Not tainted
> (3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le)
> [22061.541577] MSR: 1000000000081000 <HV,ME> CR: 00000000 XER: 00000000
> [22061.541585] CFAR: c000000000009c0c SOFTE: 0
> GPR00: 9000000000001031 c0000007e1a7bba0 c0000000012b1d00 0000000001338840
> GPR04: 0000000000000000 0000000000000000 1000000000001000 9000000000001033
> GPR08: 0000000040000000 8000000000002933 00003fff9e9d0068 0000000000000000
> GPR12: 00000000000000ff c000000007db7c00 0000000000000000 0000000000000000
> GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
> GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
> GPR24: 0000000000000000 000000000000dc58 0000000000000001 c000001ee716e000
> GPR28: 0000000000000000 c000000001338840 00003fff9db30000 0000000000000000
> [22061.541629] NIP [0000000000000000] (null)
> [22061.541637] LR [0000000000009c14] 0x9c14
> [22061.541640] Call Trace:
> [22061.541649] [c0000007e1a7bba0] [c00000000041a7f4]
> avc_has_perm_noaudit+0x54/0x110 (unreliable)
> [22061.541657] [c0000007e1a7bd80] [c00000000002ddc0] ppc_rtas+0x150/0x2d0
> [22061.541662] [c0000007e1a7be30] [c000000000009358] syscall_exit+0x0/0x98
> [22061.541666] Instruction dump:
> [22061.541669] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
> XXXXXXXX XXXXXXXX
> [22061.541675] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX 60000000 60000000
> 60000000 60000000
> [22061.541688] ---[ end trace 6f9bf0b3d32096aa ]---
>
> Reported-by: NAGESWARA R. SASTRY <nasastry@in.ibm.com>
> Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
> ---
> arch/powerpc/kernel/rtas.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
> index 84bf934..5a753fa 100644
> --- a/arch/powerpc/kernel/rtas.c
> +++ b/arch/powerpc/kernel/rtas.c
> @@ -1043,6 +1043,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user
> *uargs)
> if (!capable(CAP_SYS_ADMIN))
> return -EPERM;
>
> + if (!rtas.entry)
> + return -EINVAL;
> +
> if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
> return -EFAULT;
>
>
> _______________________________________________
> Linuxppc-dev mailing list
> Linuxppc-dev@lists.ozlabs.org
> https://lists.ozlabs.org/listinfo/linuxppc-dev
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] rtas: Validate rtas entry before calling enter_rtas
2015-10-16 10:32 ` Denis Kirjanov
@ 2015-10-16 15:14 ` Vasant Hegde
2015-10-16 18:19 ` Denis Kirjanov
0 siblings, 1 reply; 6+ messages in thread
From: Vasant Hegde @ 2015-10-16 15:14 UTC (permalink / raw)
To: Denis Kirjanov; +Cc: linuxppc-dev, ego
On 10/16/2015 04:02 PM, Denis Kirjanov wrote:
> On 10/16/15, Vasant Hegde <hegdevasant@linux.vnet.ibm.com> wrote:
>> Currently we do not validate rtas entry before calling enter_rtas(). This
>> is resulting in a kernel oops (see below) when user space calls rtas system
>> call on PowerNV platform. We hit below oops when we ran trinity (system call
>> fuzzer) on PowerNV. This patch adds code to validate rtas entry before
>> making
>> enter_rtas() call.
>
> Hi,
> have you figured out why we have null entry?
Denis,
Yes... On PowerNV platform we don't have RTAS.. Hence it's not initialized.
-Vasant
>
> Thanks!
>>
>> dmesg:
>> -----
>> [22061.541428] Oops: Exception in kernel mode, sig: 4 [#1]
>> [22061.541446] SMP NR_CPUS=1024 NUMA PowerNV
>> [22061.541453] Modules linked in: rfcomm bnep nfnetlink scsi_transport_iscsi
>> hidp nfc af_802154 ieee802154 bluetooth rfkill pppoe pppox ppp_generic slhc
>> irda crc_ccitt af_key sctp libcrc32c atm appletalk ipx p8023 psnap p8022
>> ipt_MASQUERADE nf_nat_masquerade_ipv4 xt_CHECKSUM tun ip6t_rpfilter
>> ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack
>> ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
>> ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables
>> iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack
>> iptable_mangle iptable_security iptable_raw windfarm_smu_sat ses enclosure
>> windfarm_pid shpchp i2c_opal i2c_core kvm_hv kvm_pr dm_multipath kvm lpfc
>> tg3 ptp pps_core scsi_transport_fc
>> [22061.541561] CPU: 40 PID: 57748 Comm: trinity-c11 Not tainted
>> 3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le #1
>> [22061.541566] task: c000000004294b80 ti: c0000007e1a78000 task.ti:
>> c0000007e1a78000
>> [22061.541570] NIP: 0000000000000000 LR: 0000000000009c14 CTR:
>> c000000000423140
>> [22061.541573] REGS: c0000007e1a7b920 TRAP: 0e40 Not tainted
>> (3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le)
>> [22061.541577] MSR: 1000000000081000 <HV,ME> CR: 00000000 XER: 00000000
>> [22061.541585] CFAR: c000000000009c0c SOFTE: 0
>> GPR00: 9000000000001031 c0000007e1a7bba0 c0000000012b1d00 0000000001338840
>> GPR04: 0000000000000000 0000000000000000 1000000000001000 9000000000001033
>> GPR08: 0000000040000000 8000000000002933 00003fff9e9d0068 0000000000000000
>> GPR12: 00000000000000ff c000000007db7c00 0000000000000000 0000000000000000
>> GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
>> GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
>> GPR24: 0000000000000000 000000000000dc58 0000000000000001 c000001ee716e000
>> GPR28: 0000000000000000 c000000001338840 00003fff9db30000 0000000000000000
>> [22061.541629] NIP [0000000000000000] (null)
>> [22061.541637] LR [0000000000009c14] 0x9c14
>> [22061.541640] Call Trace:
>> [22061.541649] [c0000007e1a7bba0] [c00000000041a7f4]
>> avc_has_perm_noaudit+0x54/0x110 (unreliable)
>> [22061.541657] [c0000007e1a7bd80] [c00000000002ddc0] ppc_rtas+0x150/0x2d0
>> [22061.541662] [c0000007e1a7be30] [c000000000009358] syscall_exit+0x0/0x98
>> [22061.541666] Instruction dump:
>> [22061.541669] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
>> XXXXXXXX XXXXXXXX
>> [22061.541675] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX 60000000 60000000
>> 60000000 60000000
>> [22061.541688] ---[ end trace 6f9bf0b3d32096aa ]---
>>
>> Reported-by: NAGESWARA R. SASTRY <nasastry@in.ibm.com>
>> Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
>> ---
>> arch/powerpc/kernel/rtas.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
>> index 84bf934..5a753fa 100644
>> --- a/arch/powerpc/kernel/rtas.c
>> +++ b/arch/powerpc/kernel/rtas.c
>> @@ -1043,6 +1043,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user
>> *uargs)
>> if (!capable(CAP_SYS_ADMIN))
>> return -EPERM;
>>
>> + if (!rtas.entry)
>> + return -EINVAL;
>> +
>> if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
>> return -EFAULT;
>>
>>
>> _______________________________________________
>> Linuxppc-dev mailing list
>> Linuxppc-dev@lists.ozlabs.org
>> https://lists.ozlabs.org/listinfo/linuxppc-dev
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] rtas: Validate rtas entry before calling enter_rtas
2015-10-16 15:14 ` Vasant Hegde
@ 2015-10-16 18:19 ` Denis Kirjanov
2015-10-17 4:34 ` Vasant Hegde
0 siblings, 1 reply; 6+ messages in thread
From: Denis Kirjanov @ 2015-10-16 18:19 UTC (permalink / raw)
To: Vasant Hegde; +Cc: linuxppc-dev, ego
On 10/16/15, Vasant Hegde <hegdevasant@linux.vnet.ibm.com> wrote:
> On 10/16/2015 04:02 PM, Denis Kirjanov wrote:
>> On 10/16/15, Vasant Hegde <hegdevasant@linux.vnet.ibm.com> wrote:
>>> Currently we do not validate rtas entry before calling enter_rtas().
>>> This
>>> is resulting in a kernel oops (see below) when user space calls rtas
>>> system
>>> call on PowerNV platform. We hit below oops when we ran trinity (system
>>> call
>>> fuzzer) on PowerNV. This patch adds code to validate rtas entry before
>>> making
>>> enter_rtas() call.
>>
>> Hi,
>> have you figured out why we have null entry?
>
> Denis,
>
> Yes... On PowerNV platform we don't have RTAS.. Hence it's not initialized.
But why do we have CONFIG_PPC_RTAS on OPAL machines then?
>
> -Vasant
>
>>
>> Thanks!
>>>
>>> dmesg:
>>> -----
>>> [22061.541428] Oops: Exception in kernel mode, sig: 4 [#1]
>>> [22061.541446] SMP NR_CPUS=1024 NUMA PowerNV
>>> [22061.541453] Modules linked in: rfcomm bnep nfnetlink
>>> scsi_transport_iscsi
>>> hidp nfc af_802154 ieee802154 bluetooth rfkill pppoe pppox ppp_generic
>>> slhc
>>> irda crc_ccitt af_key sctp libcrc32c atm appletalk ipx p8023 psnap p8022
>>> ipt_MASQUERADE nf_nat_masquerade_ipv4 xt_CHECKSUM tun ip6t_rpfilter
>>> ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack
>>> ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
>>> ip6table_mangle ip6table_security ip6table_raw ip6table_filter
>>> ip6_tables
>>> iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat
>>> nf_conntrack
>>> iptable_mangle iptable_security iptable_raw windfarm_smu_sat ses
>>> enclosure
>>> windfarm_pid shpchp i2c_opal i2c_core kvm_hv kvm_pr dm_multipath kvm
>>> lpfc
>>> tg3 ptp pps_core scsi_transport_fc
>>> [22061.541561] CPU: 40 PID: 57748 Comm: trinity-c11 Not tainted
>>> 3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le #1
>>> [22061.541566] task: c000000004294b80 ti: c0000007e1a78000 task.ti:
>>> c0000007e1a78000
>>> [22061.541570] NIP: 0000000000000000 LR: 0000000000009c14 CTR:
>>> c000000000423140
>>> [22061.541573] REGS: c0000007e1a7b920 TRAP: 0e40 Not tainted
>>> (3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le)
>>> [22061.541577] MSR: 1000000000081000 <HV,ME> CR: 00000000 XER:
>>> 00000000
>>> [22061.541585] CFAR: c000000000009c0c SOFTE: 0
>>> GPR00: 9000000000001031 c0000007e1a7bba0 c0000000012b1d00
>>> 0000000001338840
>>> GPR04: 0000000000000000 0000000000000000 1000000000001000
>>> 9000000000001033
>>> GPR08: 0000000040000000 8000000000002933 00003fff9e9d0068
>>> 0000000000000000
>>> GPR12: 00000000000000ff c000000007db7c00 0000000000000000
>>> 0000000000000000
>>> GPR16: 0000000000000000 0000000000000000 0000000000000000
>>> 0000000000000000
>>> GPR20: 0000000000000000 0000000000000000 0000000000000000
>>> 0000000000000000
>>> GPR24: 0000000000000000 000000000000dc58 0000000000000001
>>> c000001ee716e000
>>> GPR28: 0000000000000000 c000000001338840 00003fff9db30000
>>> 0000000000000000
>>> [22061.541629] NIP [0000000000000000] (null)
>>> [22061.541637] LR [0000000000009c14] 0x9c14
>>> [22061.541640] Call Trace:
>>> [22061.541649] [c0000007e1a7bba0] [c00000000041a7f4]
>>> avc_has_perm_noaudit+0x54/0x110 (unreliable)
>>> [22061.541657] [c0000007e1a7bd80] [c00000000002ddc0]
>>> ppc_rtas+0x150/0x2d0
>>> [22061.541662] [c0000007e1a7be30] [c000000000009358]
>>> syscall_exit+0x0/0x98
>>> [22061.541666] Instruction dump:
>>> [22061.541669] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
>>> XXXXXXXX XXXXXXXX
>>> [22061.541675] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX 60000000 60000000
>>> 60000000 60000000
>>> [22061.541688] ---[ end trace 6f9bf0b3d32096aa ]---
>>>
>>> Reported-by: NAGESWARA R. SASTRY <nasastry@in.ibm.com>
>>> Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
>>> ---
>>> arch/powerpc/kernel/rtas.c | 3 +++
>>> 1 file changed, 3 insertions(+)
>>>
>>> diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
>>> index 84bf934..5a753fa 100644
>>> --- a/arch/powerpc/kernel/rtas.c
>>> +++ b/arch/powerpc/kernel/rtas.c
>>> @@ -1043,6 +1043,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user
>>> *uargs)
>>> if (!capable(CAP_SYS_ADMIN))
>>> return -EPERM;
>>>
>>> + if (!rtas.entry)
>>> + return -EINVAL;
>>> +
>>> if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
>>> return -EFAULT;
>>>
>>>
>>> _______________________________________________
>>> Linuxppc-dev mailing list
>>> Linuxppc-dev@lists.ozlabs.org
>>> https://lists.ozlabs.org/listinfo/linuxppc-dev
>>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] rtas: Validate rtas entry before calling enter_rtas
2015-10-16 18:19 ` Denis Kirjanov
@ 2015-10-17 4:34 ` Vasant Hegde
2015-10-19 9:41 ` Michael Ellerman
0 siblings, 1 reply; 6+ messages in thread
From: Vasant Hegde @ 2015-10-17 4:34 UTC (permalink / raw)
To: Denis Kirjanov; +Cc: linuxppc-dev, ego
On 10/16/2015 11:49 PM, Denis Kirjanov wrote:
> On 10/16/15, Vasant Hegde <hegdevasant@linux.vnet.ibm.com> wrote:
>> On 10/16/2015 04:02 PM, Denis Kirjanov wrote:
>>> On 10/16/15, Vasant Hegde <hegdevasant@linux.vnet.ibm.com> wrote:
>>>> Currently we do not validate rtas entry before calling enter_rtas().
>>>> This
>>>> is resulting in a kernel oops (see below) when user space calls rtas
>>>> system
>>>> call on PowerNV platform. We hit below oops when we ran trinity (system
>>>> call
>>>> fuzzer) on PowerNV. This patch adds code to validate rtas entry before
>>>> making
>>>> enter_rtas() call.
>>>
>>> Hi,
>>> have you figured out why we have null entry?
>>
>> Denis,
Denis,
>>
>> Yes... On PowerNV platform we don't have RTAS.. Hence it's not initialized.
> But why do we have CONFIG_PPC_RTAS on OPAL machines then?
Sorry. I should have elaborated little bit..
Today we use single config to build kernel for both PowerNV and PAPR guest. So
that same ISO can be used in different environment (PAPR LPAR, PowerNV host,
guest). I believe most distro also following this method. Hence we need this
validation.
-Vasant
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] rtas: Validate rtas entry before calling enter_rtas
2015-10-17 4:34 ` Vasant Hegde
@ 2015-10-19 9:41 ` Michael Ellerman
0 siblings, 0 replies; 6+ messages in thread
From: Michael Ellerman @ 2015-10-19 9:41 UTC (permalink / raw)
To: Vasant Hegde, Denis Kirjanov; +Cc: ego, linuxppc-dev
On Sat, 2015-10-17 at 10:04 +0530, Vasant Hegde wrote:
> On 10/16/2015 11:49 PM, Denis Kirjanov wrote:
> > On 10/16/15, Vasant Hegde <hegdevasant@linux.vnet.ibm.com> wrote:
> > > On 10/16/2015 04:02 PM, Denis Kirjanov wrote:
> > > > On 10/16/15, Vasant Hegde <hegdevasant@linux.vnet.ibm.com> wrote:
> > > > > Currently we do not validate rtas entry before calling enter_rtas().
> > > >
> > > > have you figured out why we have null entry?
> > > Yes... On PowerNV platform we don't have RTAS.. Hence it's not initialized.
> > But why do we have CONFIG_PPC_RTAS on OPAL machines then?
> Today we use single config to build kernel for both PowerNV and PAPR guest. So
> that same ISO can be used in different environment (PAPR LPAR, PowerNV host,
> guest). I believe most distro also following this method. Hence we need this
> validation.
Yes that's right.
Many of our platforms can coexist. So for example you can build a 64-bit big
endian kernel with support for G5, pSeries, Powernv, PS3, IBM Cell Blades,
Pasemi, & Maple (Bimini).
That means code that is #ifdef'ed to depend on one of those platforms, may end
up running on another platform. So we usually also need a runtime check to make
sure code doesn't run in the wrong places.
You'll see a lot of initcalls are machine_xxx_initcalls(), which means they
only run if the correct platform was detected. There's also
firmware_has_feature() checks, and then also device tree based detection.
This one seems to have slipped through the cracks because the tools that call
sys_rtas() are not used on powernv machines, so no one has though to call that
syscall. And on pseries machines rtas is always present, though obviously the
code should have still checked rtas.entry to be safe.
cheers
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-10-19 9:41 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-10-16 10:23 [PATCH] rtas: Validate rtas entry before calling enter_rtas Vasant Hegde
2015-10-16 10:32 ` Denis Kirjanov
2015-10-16 15:14 ` Vasant Hegde
2015-10-16 18:19 ` Denis Kirjanov
2015-10-17 4:34 ` Vasant Hegde
2015-10-19 9:41 ` Michael Ellerman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).