linux-toradex.git/drivers/char, branch v3.14.26

hwrng: pseries - port to new read API and fix stack corruption

2014-11-21T17:23:01+00:00

commit 24c65bc7037e7d0f362c0df70d17dd72ee64b8b9 upstream.

The add_early_randomness() function in drivers/char/hw_random/core.c passes
a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
returns four 64-bit values and trashes 16 bytes on the stack.

This bug has been lying around for a long time. It got unveiled by:

commit d3cc7996473a7bdd33256029988ea690754e4e2a
Author: Amit Shah 
Date:   Thu Jul 10 15:42:34 2014 +0530

    hwrng: fetch randomness only after device init

It may trig a oops while loading or unloading the pseries-rng module for both
PowerVM and PowerKVM guests.

This patch does two things:
- pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
  since we're not on a hot path.
- move to the new read API so that we know the return buffer size for sure.

Signed-off-by: Greg Kurz 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

random: add and use memzero_explicit() for clearing data

2014-11-14T16:59:49+00:00

commit d4c5efdb97773f59a2b711754ca0953f24516739 upstream.

zatimend has reported that in his environment (3.16/gcc4.8.3/corei7)
memset() calls which clear out sensitive data in extract_{buf,entropy,
entropy_user}() in random driver are being optimized away by gcc.

Add a helper memzero_explicit() (similarly as explicit_bzero() variants)
that can be used in such cases where a variable with sensitive data is
being cleared out in the end. Other use cases might also be in crypto
code. [ I have put this into lib/string.c though, as it's always built-in
and doesn't need any dependencies then. ]

Fixes kernel bugzilla: 82041

Reported-by: zatimend@hotmail.co.uk
Signed-off-by: Daniel Borkmann 
Acked-by: Hannes Frederic Sowa 
Cc: Alexey Dobriyan 
Signed-off-by: Theodore Ts'o 
Signed-off-by: Greg Kroah-Hartman

tpm: Properly clean sysfs entries in error path

2014-09-17T16:19:08+00:00

commit b49e1043c48dac23f64fba684d31c4a96c1ffaa0 upstream.

Properly clean the sysfs entries in the error path

Reported-by: Dmitry Kasatkin 
Signed-off-by: Stefan Berger 
Reviewed-by: Jason Gunthorpe 
Signed-off-by: Peter Huewe 
Signed-off-by: Greg Kroah-Hartman

tpm: Provide a generic means to override the chip returned timeouts

2014-09-17T16:19:08+00:00

commit 8e54caf407b98efa05409e1fee0e5381abd2b088 upstream.

Some Atmel TPMs provide completely wrong timeouts from their
TPM_CAP_PROP_TIS_TIMEOUT query. This patch detects that and returns
new correct values via a DID/VID table in the TIS driver.

Tested on ARM using an AT97SC3204T FW version 37.16

[PHuewe: without this fix these 'broken' Atmel TPMs won't function on
older kernels]
Signed-off-by: "Berg, Christopher" 
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Greg Kroah-Hartman 

Signed-off-by: Peter Huewe

tpm: missing tpm_chip_put in tpm_get_random()

2014-09-17T16:19:08+00:00

commit 3e14d83ef94a5806a865b85b513b4e891923c19b upstream.

Regression in 41ab999c. Call to tpm_chip_put is missing. This
will cause TPM device driver not to unload if tmp_get_random()
is called.

Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Peter Huewe 
Signed-off-by: Greg Kroah-Hartman

tpm: Add missing tpm_do_selftest to ST33 I2C driver

2014-09-05T23:34:14+00:00

commit f07a5e9a331045e976a3d317ba43d14859d9407c upstream.

Most device drivers do call 'tpm_do_selftest' which executes a
TPM_ContinueSelfTest. tpm_i2c_stm_st33 is just pointlessly different,
I think it is bug.

These days we have the general assumption that the TPM is usable by
the kernel immediately after the driver is finished, so we can no
longer defer the mandatory self test to userspace.

Reported-by: Richard Marciel 
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Peter Huewe 
Signed-off-by: Greg Kroah-Hartman

i8k: Fix non-SMP operation

2014-07-17T23:21:03+00:00

commit 6d827fbcc370ca259a2905309f64161ab7b10596 upstream.

Commit f36fdb9f0266 (i8k: Force SMM to run on CPU 0) adds support
for multi-core CPUs to the driver. Unfortunately, that causes it
to fail loading if compiled without SMP support, at least on
32 bit kernels. Kernel log shows "i8k: unable to get SMM Dell
signature", and function i8k_smm is found to return -EINVAL.

Testing revealed that the culprit is the missing return value check
of set_cpus_allowed_ptr.

Fixes: f36fdb9f0266 (i8k: Force SMM to run on CPU 0)
Reported-by: Jim Bos 
Tested-by: Jim Bos 
Signed-off-by: Guenter Roeck 
Cc: Andreas Mohr 
Signed-off-by: Greg Kroah-Hartman

applicom: dereferencing NULL on error path

2014-07-01T03:11:52+00:00

commit 8bab797c6e5724a43b7666ad70860712365cdb71 upstream.

This is a static checker fix.  The "dev" variable is always NULL after
the while statement so we would be dereferencing a NULL pointer here.

Fixes: 819a3eba4233 ('[PATCH] applicom: fix error handling')
Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

ACPI / TPM: Fix resume regression on Chromebooks

2014-06-07T17:28:27+00:00

commit f759546498d820670934c901a2fdf1ce948d2e5c upstream.

Chromebooks (at least Acer C720 and Pixel) implement an ACPI object
for TPM, but don't implement the _DSM method to support PPI.  As
a result, the TPM driver fails to load on those machines after
commit 1569a4c4ceba (ACPI / TPM: detect PPI features by checking
availability of _DSM functions) which causes them to fail to
resume from system suspend, becuase they require the TPM hardware
to be put into the right state during resume and the TPM driver
is necessary for that.

Fix the problem by making tpm_add_ppi() return 0 when tpm_ppi_handle
is still NULL after walking the ACPI namespace in search for the PPI
_DSM, which allows the TPM driver to load and operate the hardware
(during system resume in particular), but avoid creating the PPI
sysfs group in that case.

This change is based on a prototype patch from Jiang Liu.

Fixes: 1569a4c4ceba (ACPI / TPM: detect PPI features by checking availability of _DSM functions)
References: https://bugzilla.kernel.org/show_bug.cgi?id=74021
Reported-by: James Duley 
Reported-by: Phillip Dixon 
Tested-by: Brandon Casey 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman

ipmi: Reset the KCS timeout when starting error recovery

2014-06-07T17:28:10+00:00

commit eb6d78ec213e6938559b801421d64714dafcf4b2 upstream.

The OBF timer in KCS was not reset in one situation when error recovery
was started, resulting in an immediate timeout.

Reported-by: Bodo Stroesser 
Signed-off-by: Corey Minyard 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman