Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 517ab153 authored by Eric Biggers's avatar Eric Biggers Committed by Greg Kroah-Hartman
Browse files

random: fix data race on crng init time 



commit 009ba8568be497c640cab7571f7bfd18345d7b24 upstream.

_extract_crng() does plain loads of crng->init_time and
crng_global_init_time, which causes undefined behavior if
crng_reseed() and RNDRESEEDCRNG modify these corrently.

Use READ_ONCE() and WRITE_ONCE() to make the behavior defined.

Don't fix the race on crng->init_time by protecting it with crng->lock,
since it's not a problem for duplicate reseedings to occur.  I.e., the
lockless access with READ_ONCE() is fine.

Fixes: d848e5f8 ("random: add new ioctl RNDRESEEDCRNG")
Fixes: e192be9d ("random: replace non-blocking pool with a Chacha20-based CRNG")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Acked-by: default avatarPaul E. McKenney <paulmck@kernel.org>
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 90ceecda

drivers/char/random.c

+10 −7
Original line number Diff line number Diff line
@@ -1042,7 +1042,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r) 
		crng->state[i+4] ^= buf.key[i] ^ rv;

	}

	memzero_explicit(&buf, sizeof(buf));

	crng->init_time = jiffies;

	WRITE_ONCE(crng->init_time, jiffies);

	spin_unlock_irqrestore(&crng->lock, flags);

	if (crng == &primary_crng && crng_init < 2) {

		invalidate_batched_entropy();
@@ -1069,12 +1069,15 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r) 
static void _extract_crng(struct crng_state *crng,

			  __u8 out[CHACHA_BLOCK_SIZE])

{

	unsigned long v, flags;

	unsigned long v, flags, init_time;



	if (crng_ready() &&

	    (time_after(crng_global_init_time, crng->init_time) ||

	     time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL)))

		crng_reseed(crng, crng == &primary_crng ? &input_pool : NULL);

	if (crng_ready()) {

		init_time = READ_ONCE(crng->init_time);

		if (time_after(READ_ONCE(crng_global_init_time), init_time) ||

		    time_after(jiffies, init_time + CRNG_RESEED_INTERVAL))

			crng_reseed(crng, crng == &primary_crng ?

				    &input_pool : NULL);

	}

	spin_lock_irqsave(&crng->lock, flags);

	if (arch_get_random_long(&v))

		crng->state[14] ^= v;
@@ -2152,7 +2155,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg) 
		if (crng_init < 2)

			return -ENODATA;

		crng_reseed(&primary_crng, &input_pool);

		crng_global_init_time = jiffies - 1;

		WRITE_ONCE(crng_global_init_time, jiffies - 1);

		return 0;

	default:

		return -EINVAL;