Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-linus-7.0-1' of https://github.com/cminyard/linux-ipmi
Pull IPMI driver fixes from Corey Minyard:
"This mostly revolves around getting the driver to behave when the IPMI
device misbehaves. Past attempts have not worked very well because I
didn't have hardware I could make do this, and AI was fairly useless
for help on this.
So I modified qemu and my test suite so I could reproduce a
misbehaving IPMI device, and with that I was able to fix the issues"
* tag 'for-linus-7.0-1' of https://github.com/cminyard/linux-ipmi:
ipmi:si: Fix check for a misbehaving BMC
ipmi:msghandler: Handle error returns from the SMI sender
ipmi:si: Don't block module unload if the BMC is messed up
ipmi:si: Use a long timeout when the BMC is misbehaving
ipmi:si: Handle waiting messages when BMC failure detected
ipmi:ls2k: Make ipmi_ls2k_platform_driver static
ipmi: ipmb: initialise event handler read bytes
ipmi: Consolidate the run to completion checking for xmit msgs lock
ipmi: Fix use-after-free and list corruption on sender error
+126
-61
+5
drivers/char/ipmi/ipmi_ipmb.c
+5
drivers/char/ipmi/ipmi_ipmb.c
···
202
202
break;
203
203
204
204
case I2C_SLAVE_READ_REQUESTED:
205
+
*val = 0xff;
206
+
ipmi_ipmb_check_msg_done(iidev);
207
+
break;
208
+
205
209
case I2C_SLAVE_STOP:
206
210
ipmi_ipmb_check_msg_done(iidev);
207
211
break;
208
212
209
213
case I2C_SLAVE_READ_PROCESSED:
214
+
*val = 0xff;
210
215
break;
211
216
}
212
217
+96
-47
drivers/char/ipmi/ipmi_msghandler.c
+96
-47
drivers/char/ipmi/ipmi_msghandler.c
···
602
602
static int __scan_channels(struct ipmi_smi *intf,
603
603
struct ipmi_device_id *id, bool rescan);
604
604
605
+
static void ipmi_lock_xmit_msgs(struct ipmi_smi *intf, int run_to_completion,
606
+
unsigned long *flags)
607
+
{
608
+
if (run_to_completion)
609
+
return;
610
+
spin_lock_irqsave(&intf->xmit_msgs_lock, *flags);
611
+
}
612
+
613
+
static void ipmi_unlock_xmit_msgs(struct ipmi_smi *intf, int run_to_completion,
614
+
unsigned long *flags)
615
+
{
616
+
if (run_to_completion)
617
+
return;
618
+
spin_unlock_irqrestore(&intf->xmit_msgs_lock, *flags);
619
+
}
620
+
605
621
static void free_ipmi_user(struct kref *ref)
606
622
{
607
623
struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
···
1885
1869
return smi_msg;
1886
1870
}
1887
1871
1888
-
static void smi_send(struct ipmi_smi *intf,
1872
+
static int smi_send(struct ipmi_smi *intf,
1889
1873
const struct ipmi_smi_handlers *handlers,
1890
1874
struct ipmi_smi_msg *smi_msg, int priority)
1891
1875
{
1892
1876
int run_to_completion = READ_ONCE(intf->run_to_completion);
1893
1877
unsigned long flags = 0;
1878
+
int rv = 0;
1894
1879
1895
-
if (!run_to_completion)
1896
-
spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
1880
+
ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
1897
1881
smi_msg = smi_add_send_msg(intf, smi_msg, priority);
1898
-
if (!run_to_completion)
1899
-
spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
1882
+
ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
1900
1883
1901
-
if (smi_msg)
1902
-
handlers->sender(intf->send_info, smi_msg);
1884
+
if (smi_msg) {
1885
+
rv = handlers->sender(intf->send_info, smi_msg);
1886
+
if (rv) {
1887
+
ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
1888
+
intf->curr_msg = NULL;
1889
+
ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
1890
+
/*
1891
+
* Something may have been added to the transmit
1892
+
* queue, so schedule a check for that.
1893
+
*/
1894
+
queue_work(system_wq, &intf->smi_work);
1895
+
}
1896
+
}
1897
+
return rv;
1903
1898
}
1904
1899
1905
1900
static bool is_maintenance_mode_cmd(struct kernel_ipmi_msg *msg)
···
2323
2296
struct ipmi_recv_msg *recv_msg;
2324
2297
int run_to_completion = READ_ONCE(intf->run_to_completion);
2325
2298
int rv = 0;
2299
+
bool in_seq_table = false;
2326
2300
2327
2301
if (supplied_recv) {
2328
2302
recv_msg = supplied_recv;
···
2377
2349
rv = i_ipmi_req_ipmb(intf, addr, msgid, msg, smi_msg, recv_msg,
2378
2350
source_address, source_lun,
2379
2351
retries, retry_time_ms);
2352
+
in_seq_table = true;
2380
2353
} else if (is_ipmb_direct_addr(addr)) {
2381
2354
rv = i_ipmi_req_ipmb_direct(intf, addr, msgid, msg, smi_msg,
2382
2355
recv_msg, source_lun);
2383
2356
} else if (is_lan_addr(addr)) {
2384
2357
rv = i_ipmi_req_lan(intf, addr, msgid, msg, smi_msg, recv_msg,
2385
2358
source_lun, retries, retry_time_ms);
2359
+
in_seq_table = true;
2386
2360
} else {
2387
-
/* Unknown address type. */
2361
+
/* Unknown address type. */
2388
2362
ipmi_inc_stat(intf, sent_invalid_commands);
2389
2363
rv = -EINVAL;
2390
2364
}
2391
2365
2392
-
if (rv) {
2366
+
if (!rv) {
2367
+
dev_dbg(intf->si_dev, "Send: %*ph\n",
2368
+
smi_msg->data_size, smi_msg->data);
2369
+
2370
+
rv = smi_send(intf, intf->handlers, smi_msg, priority);
2371
+
if (rv != IPMI_CC_NO_ERROR)
2372
+
/* smi_send() returns an IPMI err, return a Linux one. */
2373
+
rv = -EIO;
2374
+
if (rv && in_seq_table) {
2375
+
/*
2376
+
* If it's in the sequence table, it will be
2377
+
* retried later, so ignore errors.
2378
+
*/
2379
+
rv = 0;
2380
+
/* But we need to fix the timeout. */
2381
+
intf_start_seq_timer(intf, smi_msg->msgid);
2382
+
ipmi_free_smi_msg(smi_msg);
2383
+
smi_msg = NULL;
2384
+
}
2385
+
}
2393
2386
out_err:
2387
+
if (!run_to_completion)
2388
+
mutex_unlock(&intf->users_mutex);
2389
+
2390
+
if (rv) {
2394
2391
if (!supplied_smi)
2395
2392
ipmi_free_smi_msg(smi_msg);
2396
2393
if (!supplied_recv)
2397
2394
ipmi_free_recv_msg(recv_msg);
2398
-
} else {
2399
-
dev_dbg(intf->si_dev, "Send: %*ph\n",
2400
-
smi_msg->data_size, smi_msg->data);
2401
-
2402
-
smi_send(intf, intf->handlers, smi_msg, priority);
2403
2395
}
2404
-
if (!run_to_completion)
2405
-
mutex_unlock(&intf->users_mutex);
2406
-
2407
2396
return rv;
2408
2397
}
2409
2398
···
3994
3949
dev_dbg(intf->si_dev, "Invalid command: %*ph\n",
3995
3950
msg->data_size, msg->data);
3996
3951
3997
-
smi_send(intf, intf->handlers, msg, 0);
3998
-
/*
3999
-
* We used the message, so return the value that
4000
-
* causes it to not be freed or queued.
4001
-
*/
4002
-
rv = -1;
3952
+
if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR)
3953
+
/*
3954
+
* We used the message, so return the value that
3955
+
* causes it to not be freed or queued.
3956
+
*/
3957
+
rv = -1;
4003
3958
} else if (!IS_ERR(recv_msg)) {
4004
3959
/* Extract the source address from the data. */
4005
3960
ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
···
4073
4028
msg->data[4] = IPMI_INVALID_CMD_COMPLETION_CODE;
4074
4029
msg->data_size = 5;
4075
4030
4076
-
smi_send(intf, intf->handlers, msg, 0);
4077
-
/*
4078
-
* We used the message, so return the value that
4079
-
* causes it to not be freed or queued.
4080
-
*/
4081
-
rv = -1;
4031
+
if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR)
4032
+
/*
4033
+
* We used the message, so return the value that
4034
+
* causes it to not be freed or queued.
4035
+
*/
4036
+
rv = -1;
4082
4037
} else if (!IS_ERR(recv_msg)) {
4083
4038
/* Extract the source address from the data. */
4084
4039
daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr;
···
4218
4173
struct ipmi_smi_msg *msg)
4219
4174
{
4220
4175
struct cmd_rcvr *rcvr;
4221
-
int rv = 0;
4176
+
int rv = 0; /* Free by default */
4222
4177
unsigned char netfn;
4223
4178
unsigned char cmd;
4224
4179
unsigned char chan;
···
4271
4226
dev_dbg(intf->si_dev, "Invalid command: %*ph\n",
4272
4227
msg->data_size, msg->data);
4273
4228
4274
-
smi_send(intf, intf->handlers, msg, 0);
4275
-
/*
4276
-
* We used the message, so return the value that
4277
-
* causes it to not be freed or queued.
4278
-
*/
4279
-
rv = -1;
4229
+
if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR)
4230
+
/*
4231
+
* We used the message, so return the value that
4232
+
* causes it to not be freed or queued.
4233
+
*/
4234
+
rv = -1;
4280
4235
} else if (!IS_ERR(recv_msg)) {
4281
4236
/* Extract the source address from the data. */
4282
4237
lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
···
4869
4824
* message delivery.
4870
4825
*/
4871
4826
restart:
4872
-
if (!run_to_completion)
4873
-
spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
4827
+
ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
4874
4828
if (intf->curr_msg == NULL && !intf->in_shutdown) {
4875
4829
struct list_head *entry = NULL;
4876
4830
···
4885
4841
intf->curr_msg = newmsg;
4886
4842
}
4887
4843
}
4888
-
if (!run_to_completion)
4889
-
spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
4844
+
ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
4890
4845
4891
4846
if (newmsg) {
4892
4847
cc = intf->handlers->sender(intf->send_info, newmsg);
···
4893
4850
if (newmsg->recv_msg)
4894
4851
deliver_err_response(intf,
4895
4852
newmsg->recv_msg, cc);
4896
-
else
4897
-
ipmi_free_smi_msg(newmsg);
4853
+
ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
4854
+
intf->curr_msg = NULL;
4855
+
ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
4856
+
ipmi_free_smi_msg(newmsg);
4857
+
newmsg = NULL;
4898
4858
goto restart;
4899
4859
}
4900
4860
}
···
4965
4919
spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
4966
4920
flags);
4967
4921
4968
-
if (!run_to_completion)
4969
-
spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
4922
+
ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
4970
4923
/*
4971
4924
* We can get an asynchronous event or receive message in addition
4972
4925
* to commands we send.
4973
4926
*/
4974
4927
if (msg == intf->curr_msg)
4975
4928
intf->curr_msg = NULL;
4976
-
if (!run_to_completion)
4977
-
spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
4929
+
ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
4978
4930
4979
4931
if (run_to_completion)
4980
4932
smi_work(&intf->smi_work);
···
5085
5041
ipmi_inc_stat(intf,
5086
5042
retransmitted_ipmb_commands);
5087
5043
5088
-
smi_send(intf, intf->handlers, smi_msg, 0);
5044
+
/* If this fails we'll retry later or timeout. */
5045
+
if (smi_send(intf, intf->handlers, smi_msg, 0) != IPMI_CC_NO_ERROR) {
5046
+
/* But fix the timeout. */
5047
+
intf_start_seq_timer(intf, smi_msg->msgid);
5048
+
ipmi_free_smi_msg(smi_msg);
5049
+
}
5089
5050
} else
5090
5051
ipmi_free_smi_msg(smi_msg);
5091
5052
+24
-13
drivers/char/ipmi/ipmi_si_intf.c
+24
-13
drivers/char/ipmi/ipmi_si_intf.c
···
809
809
*/
810
810
return_hosed_msg(smi_info, IPMI_BUS_ERR);
811
811
}
812
+
if (smi_info->waiting_msg != NULL) {
813
+
/* Also handle if there was a message waiting. */
814
+
smi_info->curr_msg = smi_info->waiting_msg;
815
+
smi_info->waiting_msg = NULL;
816
+
return_hosed_msg(smi_info, IPMI_BUS_ERR);
817
+
}
812
818
smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_HOSED);
813
819
goto out;
814
820
}
···
924
918
{
925
919
struct smi_info *smi_info = send_info;
926
920
unsigned long flags;
921
+
int rv = IPMI_CC_NO_ERROR;
927
922
928
923
debug_timestamp(smi_info, "Enqueue");
929
924
925
+
/*
926
+
* Check here for run to completion mode. A check under lock is
927
+
* later.
928
+
*/
930
929
if (smi_info->si_state == SI_HOSED)
931
930
return IPMI_BUS_ERR;
932
931
···
945
934
}
946
935
947
936
spin_lock_irqsave(&smi_info->si_lock, flags);
948
-
/*
949
-
* The following two lines don't need to be under the lock for
950
-
* the lock's sake, but they do need SMP memory barriers to
951
-
* avoid getting things out of order. We are already claiming
952
-
* the lock, anyway, so just do it under the lock to avoid the
953
-
* ordering problem.
954
-
*/
955
-
BUG_ON(smi_info->waiting_msg);
956
-
smi_info->waiting_msg = msg;
957
-
check_start_timer_thread(smi_info);
937
+
if (smi_info->si_state == SI_HOSED) {
938
+
rv = IPMI_BUS_ERR;
939
+
} else {
940
+
BUG_ON(smi_info->waiting_msg);
941
+
smi_info->waiting_msg = msg;
942
+
check_start_timer_thread(smi_info);
943
+
}
958
944
spin_unlock_irqrestore(&smi_info->si_lock, flags);
959
-
return IPMI_CC_NO_ERROR;
945
+
return rv;
960
946
}
961
947
962
948
static void set_run_to_completion(void *send_info, bool i_run_to_completion)
···
1121
1113
* SI_USEC_PER_JIFFY);
1122
1114
smi_result = smi_event_handler(smi_info, time_diff);
1123
1115
1124
-
if ((smi_info->io.irq) && (!smi_info->interrupt_disabled)) {
1116
+
if (smi_info->si_state == SI_HOSED) {
1117
+
timeout = jiffies + SI_TIMEOUT_HOSED;
1118
+
} else if ((smi_info->io.irq) && (!smi_info->interrupt_disabled)) {
1125
1119
/* Running with interrupts, only do long timeouts. */
1126
1120
timeout = jiffies + SI_TIMEOUT_JIFFIES;
1127
1121
smi_inc_stat(smi_info, long_timeouts);
···
2236
2226
unsigned long jiffies_now;
2237
2227
long time_diff;
2238
2228
2239
-
while (smi_info->curr_msg || (smi_info->si_state != SI_NORMAL)) {
2229
+
while (smi_info->si_state != SI_HOSED &&
2230
+
(smi_info->curr_msg || (smi_info->si_state != SI_NORMAL))) {
2240
2231
jiffies_now = jiffies;
2241
2232
time_diff = (((long)jiffies_now - (long)smi_info->last_timeout_jiffies)
2242
2233
* SI_USEC_PER_JIFFY);