History

Merge tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi

Pull ipmi updates from Corey Minyard: "Several cleanup on error fixes and a missing RCU wait and proper validation on a received message in one place. The biggest change is the initialization of the driver can be done asynchronously on a work queue. That saves significant boot time" * tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() ipmi:msghandler: Cancel work cleanly on an error ipmi:si: Add async init to ipmi_si char: ipmi: use named initializers for acpi_device_id ipmi: Fix leak in __ipmi_bmc_register ipmi: Remove all sysfs files on registration failure ipmi: si: Fix NULL pointer dereference after failed registration ipmi: ipmb: validate write message length

Linus Torvalds committed 2 months ago

Commit 4cc4cc32 parents 548e7bc 05ec76c6 files · +86 −24Browse files

Unified · Split

6 files
  1. drivers/char/ipmi/Kconfig +9 −0
  2. drivers/char/ipmi/ipmb_dev_int.c +5 −4
  3. drivers/char/ipmi/ipmi_msghandler.c +5 −0
  4. drivers/char/ipmi/ipmi_si_intf.c +63 −16
  5. drivers/char/ipmi/ipmi_si_platform.c +2 −2
  6. drivers/char/ipmi/ipmi_ssif.c +2 −2
drivers/char/ipmi/Kconfig+9−0
@@ -67,6 +67,15 @@ config IPMI_SI · 66 unmodified lines
6767 Currently, only KCS and SMIC are supported. If
6868 you are using IPMI, you should probably say "y" here.
6969
70+config IPMI_SI_ASYNC_INIT
71+ bool 'Asynchronous initialization of IPMI System Interface'
72+ depends on IPMI_SI
73+ default n
74+ help
75+ Offloads individual SMI inits. It speeds up the boot time.
76+ It also introduces a very small risk that something else might fail
77+ if it depends on synchronous IPMI init.
78+
7079 config IPMI_SSIF
7180 tristate 'IPMI SMBus handler (SSIF)'
7281 depends on I2C
drivers/char/ipmi/ipmb_dev_int.c+5−4
@@ -141,13 +141,14 @@ static ssize_t ipmb_write(struct file *file, const char __user *buf, · 140 unmodified lines
141141 u8 msg[MAX_MSG_LEN];
142142 ssize_t ret;
143143
144− if (count > sizeof(msg))
144+ if (!count || count > sizeof(msg))
145145 return -EINVAL;
146146
147147 if (copy_from_user(&msg, buf, count))
148148 return -EFAULT;
149149
150− if (count < msg[0])
150+ if (msg[IPMB_MSG_LEN_IDX] < IPMB_REQUEST_LEN_MIN ||
151+ count < (size_t)msg[IPMB_MSG_LEN_IDX] + 1)
151152 return -EINVAL;
152153
153154 rq_sa = GET_7BIT_ADDR(msg[RQ_SA_8BIT_IDX]);
@@ -360,8 +361,8 @@ MODULE_DEVICE_TABLE(i2c, ipmb_id); · 206 unmodified lines
360361
361362 #ifdef CONFIG_ACPI
362363 static const struct acpi_device_id acpi_ipmb_id[] = {
363− { "IPMB0001", 0 },
364− {},
364+ { .id = "IPMB0001" },
365+ { }
365366 };
366367 MODULE_DEVICE_TABLE(acpi, acpi_ipmb_id);
367368 #endif
drivers/char/ipmi/ipmi_msghandler.c+5−0
@@ -1391,6 +1391,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user) · 1390 unmodified lines
13911391 }
13921392 }
13931393 mutex_unlock(&intf->cmd_rcvrs_mutex);
1394+ synchronize_rcu();
13941395 while (rcvrs) {
13951396 rcvr = rcvrs;
13961397 rcvrs = rcvr->next;
@@ -3301,6 +3302,7 @@ out_list_del: · 1904 unmodified lines
33013302 list_del(&intf->bmc_link);
33023303 mutex_unlock(&bmc->dyn_mutex);
33033304 intf->bmc = &intf->tmp_bmc;
3305+ ida_free(&ipmi_bmc_ida, bmc->pdev.id);
33043306 put_device(&bmc->pdev.dev);
33053307 goto out;
33063308 }
@@ -3740,6 +3742,7 @@ int ipmi_add_smi(struct module *owner, · 433 unmodified lines
37403742 sysfs_attr_init(&intf->maintenance_mode_devattr.attr);
37413743 rv = device_create_file(intf->si_dev, &intf->maintenance_mode_devattr);
37423744 if (rv) {
3745+ device_remove_file(intf->si_dev, &intf->nr_msgs_devattr);
37433746 device_remove_file(intf->si_dev, &intf->nr_users_devattr);
37443747 goto out_err_bmc_reg;
37453748 }
@@ -3757,12 +3760,14 @@ int ipmi_add_smi(struct module *owner, · 11 unmodified lines
37573760 out_err_bmc_reg:
37583761 ipmi_bmc_unregister(intf);
37593762 out_err_started:
3763+ intf->in_shutdown = true;
37603764 if (intf->handlers->shutdown)
37613765 intf->handlers->shutdown(intf->send_info);
37623766 out_err:
37633767 list_del(&intf->link);
37643768 mutex_unlock(&ipmi_interfaces_mutex);
37653769 mutex_unlock(&smi_watchers_mutex);
3770+ cancel_work_sync(&intf->smi_work);
37663771 kref_put(&intf->refcount, intf_free);
37673772
37683773 return rv;
drivers/char/ipmi/ipmi_si_intf.c+63−16
@@ -39,6 +39,7 @@ · 38 unmodified lines
3939 #include <linux/rcupdate.h>
4040 #include <linux/ipmi.h>
4141 #include <linux/ipmi_smi.h>
42+#include <linux/workqueue.h>
4243 #include "ipmi_si.h"
4344 #include "ipmi_si_sm.h"
4445 #include <linux/string.h>
@@ -252,6 +253,8 @@ struct smi_info { · 207 unmodified lines
252253
253254 struct task_struct *thread;
254255
256+ struct work_struct init_work;
257+
255258 struct list_head link;
256259 };
257260
@@ -272,6 +275,7 @@ static bool unload_when_empty = true; · 14 unmodified lines
272275 static int try_smi_init(struct smi_info *smi);
273276 static void cleanup_one_si(struct smi_info *smi_info);
274277 static void cleanup_ipmi_si(void);
278+static void smi_init_work_fn(struct work_struct *work);
275279
276280 #ifdef DEBUG_TIMING
277281 void debug_timestamp(struct smi_info *smi_info, char *msg)
@@ -1970,6 +1974,7 @@ int ipmi_si_add_smi(struct si_sm_io *io) · 1692 unmodified lines
19701974 if (!new_smi)
19711975 return -ENOMEM;
19721976 spin_lock_init(&new_smi->si_lock);
1977+ INIT_WORK(&new_smi->init_work, smi_init_work_fn);
19731978
19741979 new_smi->io = *io;
19751980
@@ -1982,7 +1987,12 @@ int ipmi_si_add_smi(struct si_sm_io *io) · 6 unmodified lines
19821987 dev_info(dup->io.dev,
19831988 "Removing SMBIOS-specified %s state machine in favor of ACPI\n",
19841989 si_to_str[new_smi->io.si_info->type]);
1990+ list_del(&dup->link);
1991+ mutex_unlock(&smi_infos_lock);
1992+
19851993 cleanup_one_si(dup);
1994+
1995+ mutex_lock(&smi_infos_lock);
19861996 } else {
19871997 dev_info(new_smi->io.dev,
19881998 "%s-specified %s state machine: duplicate\n",
@@ -2000,8 +2010,12 @@ int ipmi_si_add_smi(struct si_sm_io *io) · 11 unmodified lines
20002010
20012011 list_add_tail(&new_smi->link, &smi_infos);
20022012
2003− if (initialized)
2004− rv = try_smi_init(new_smi);
2013+ if (initialized) {
2014+ if (IS_ENABLED(CONFIG_IPMI_SI_ASYNC_INIT))
2015+ queue_work(system_dfl_wq, &new_smi->init_work);
2016+ else
2017+ rv = try_smi_init(new_smi);
2018+ }
20052019 out_err:
20062020 mutex_unlock(&smi_infos_lock);
20072021 return rv;
@@ -2174,6 +2188,15 @@ static bool __init ipmi_smi_info_same(struct smi_info *e1, struct smi_info *e2) · 166 unmodified lines
21742188 e1->io.addr_data == e2->io.addr_data);
21752189 }
21762190
2191+static void smi_init_work_fn(struct work_struct *work)
2192+{
2193+ struct smi_info *smi = container_of(work, struct smi_info, init_work);
2194+
2195+ mutex_lock(&smi_infos_lock);
2196+ try_smi_init(smi);
2197+ mutex_unlock(&smi_infos_lock);
2198+}
2199+
21772200 static int __init init_ipmi_si(void)
21782201 {
21792202 struct smi_info *e, *e2;
@@ -2219,8 +2242,12 @@ static int __init init_ipmi_si(void) · 39 unmodified lines
22192242 break;
22202243 }
22212244 }
2222− if (!dup)
2223− try_smi_init(e);
2245+ if (!dup) {
2246+ if (IS_ENABLED(CONFIG_IPMI_SI_ASYNC_INIT))
2247+ queue_work(system_unbound_wq, &e->init_work);
2248+ else
2249+ try_smi_init(e);
2250+ }
22242251 }
22252252
22262253 /*
@@ -2253,8 +2280,12 @@ static int __init init_ipmi_si(void) · 26 unmodified lines
22532280 break;
22542281 }
22552282 }
2256− if (!dup)
2257− try_smi_init(e);
2283+ if (!dup) {
2284+ if (IS_ENABLED(CONFIG_IPMI_SI_ASYNC_INIT))
2285+ queue_work(system_unbound_wq, &e->init_work);
2286+ else
2287+ try_smi_init(e);
2288+ }
22582289 }
22592290
22602291 initialized = true;
@@ -2344,31 +2375,36 @@ static void shutdown_smi(void *send_info) · 83 unmodified lines
23442375 }
23452376
23462377 /*
2347− * Must be called with smi_infos_lock held, to serialize the
2348− * smi_info->intf check.
2378+ * Must be called with smi_info unlinked from smi_infos and smi_infos_lock released.
23492379 */
23502380 static void cleanup_one_si(struct smi_info *smi_info)
23512381 {
23522382 if (!smi_info)
23532383 return;
23542384
2355− list_del(&smi_info->link);
2385+ if (IS_ENABLED(CONFIG_IPMI_SI_ASYNC_INIT))
2386+ cancel_work_sync(&smi_info->init_work);
2387+
23562388 ipmi_unregister_smi(smi_info->intf);
23572389 kfree(smi_info);
23582390 }
23592391
23602392 void ipmi_si_remove_by_dev(struct device *dev)
23612393 {
2362− struct smi_info *e;
2394+ struct smi_info *e = NULL, *tmp;
23632395
23642396 mutex_lock(&smi_infos_lock);
2365− list_for_each_entry(e, &smi_infos, link) {
2366− if (e->io.dev == dev) {
2367− cleanup_one_si(e);
2397+ list_for_each_entry(tmp, &smi_infos, link) {
2398+ if (tmp->io.dev == dev) {
2399+ e = tmp;
2400+ list_del(&e->link);
23682401 break;
23692402 }
23702403 }
23712404 mutex_unlock(&smi_infos_lock);
2405+
2406+ if (e)
2407+ cleanup_one_si(e);
23722408 }
23732409
23742410 struct device *ipmi_si_remove_by_data(int addr_space, enum si_type si_type,
@@ -2377,6 +2413,7 @@ struct device *ipmi_si_remove_by_data(int addr_space, enum si_type si_type, · 2 unmodified lines
23772413 /* remove */
23782414 struct smi_info *e, *tmp_e;
23792415 struct device *dev = NULL;
2416+ LIST_HEAD(to_clean);
23802417
23812418 mutex_lock(&smi_infos_lock);
23822419 list_for_each_entry_safe(e, tmp_e, &smi_infos, link) {
@@ -2386,17 +2423,23 @@ struct device *ipmi_si_remove_by_data(int addr_space, enum si_type si_type, · 3 unmodified lines
23862423 continue;
23872424 if (e->io.addr_data == addr) {
23882425 dev = get_device(e->io.dev);
2389− cleanup_one_si(e);
2426+ list_move_tail(&e->link, &to_clean);
23902427 }
23912428 }
23922429 mutex_unlock(&smi_infos_lock);
23932430
2431+ list_for_each_entry_safe(e, tmp_e, &to_clean, link) {
2432+ list_del(&e->link);
2433+ cleanup_one_si(e);
2434+ }
2435+
23942436 return dev;
23952437 }
23962438
23972439 static void cleanup_ipmi_si(void)
23982440 {
23992441 struct smi_info *e, *tmp_e;
2442+ LIST_HEAD(to_clean);
24002443
24012444 if (!initialized)
24022445 return;
@@ -2410,10 +2453,14 @@ static void cleanup_ipmi_si(void) · 7 unmodified lines
24102453 ipmi_si_platform_shutdown();
24112454
24122455 mutex_lock(&smi_infos_lock);
2413− list_for_each_entry_safe(e, tmp_e, &smi_infos, link)
2414− cleanup_one_si(e);
2456+ list_splice_init(&smi_infos, &to_clean);
24152457 mutex_unlock(&smi_infos_lock);
24162458
2459+ list_for_each_entry_safe(e, tmp_e, &to_clean, link) {
2460+ list_del(&e->link);
2461+ cleanup_one_si(e);
2462+ }
2463+
24172464 ipmi_si_hardcode_exit();
24182465 ipmi_si_hotmod_exit();
24192466 }
drivers/char/ipmi/ipmi_si_platform.c+2−2
@@ -387,8 +387,8 @@ static int acpi_ipmi_probe(struct platform_device *pdev) · 386 unmodified lines
387387 }
388388
389389 static const struct acpi_device_id acpi_ipmi_match[] = {
390− { "IPI0001", 0 },
391− { },
390+ { .id = "IPI0001" },
391+ { }
392392 };
393393 MODULE_DEVICE_TABLE(acpi, acpi_ipmi_match);
394394 #else
drivers/char/ipmi/ipmi_ssif.c+2−2
@@ -2057,8 +2057,8 @@ static unsigned short *ssif_address_list(void) · 2056 unmodified lines
20572057
20582058 #ifdef CONFIG_ACPI
20592059 static const struct acpi_device_id ssif_acpi_match[] = {
2060− { "IPI0001", 0 },
2061− { },
2060+ { .id = "IPI0001" },
2061+ { }
20622062 };
20632063 MODULE_DEVICE_TABLE(acpi, ssif_acpi_match);
20642064 #endif

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t