netdev - Re: [PATCH 1/2] random32: make prandom

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 14 Sep 2020 18:16:40 +0200
From:   Sedat Dilek <sedat.dilek@...il.com>
To:     Amit Klein <aksecurity@...il.com>
Cc:     Willy Tarreau <w@....eu>, David Laight <David.Laight@...lab.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        George Spelvin <lkml@....org>,
        Eric Dumazet <edumazet@...gle.com>,
        "Jason A. Donenfeld" <Jason@...c4.com>,
        Andy Lutomirski <luto@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Peter Zijlstra <peterz@...radead.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        "tytso@....edu" <tytso@....edu>, Florian Westphal <fw@...len.de>,
        Marc Plumb <lkml.mplumb@...il.com>
Subject: Re: [PATCH 1/2] random32: make prandom_u32() output unpredictable

On Mon, Sep 14, 2020 at 4:53 PM Amit Klein <aksecurity@...il.com> wrote:
>
> Hi
>
> Is this patch being pushed to any branch? I don't see it deployed anywhere (unless I'm missing something...).
>

It's here:

[1] https://git.kernel.org/pub/scm/linux/kernel/git/wtarreau/prandom.git/log/?h=20200901-siphash-noise

> Best,
> -Amit
>
>
>
> On Tue, Sep 1, 2020 at 4:16 PM Willy Tarreau <w@....eu> wrote:
>>
>> On Tue, Sep 01, 2020 at 01:10:18PM +0000, David Laight wrote:
>> > From: Willy Tarreau
>> > > Sent: 01 September 2020 07:43
>> > ...
>> > > +/*
>> > > + * Generate some initially weak seeding values to allow
>> > > + * the prandom_u32() engine to be started.
>> > > + */
>> > > +static int __init prandom_init_early(void)
>> > > +{
>> > > +   int i;
>> > > +   unsigned long v0, v1, v2, v3;
>> > > +
>> > > +   if (!arch_get_random_long(&v0))
>> > > +           v0 = jiffies;
>> >
>> > Isn't jiffies likely to be zero here?
>>
>> I don't know. But do we really care ? I'd personally have been fine
>> with not even assigning it in this case and leaving whatever was in
>> the stack in this case, though it could make some static code analyzer
>> unhappy.
>>
>> Willy