linux-kernel - Re: [PATCH] hwrng: pseries - port to new read API and fix stack corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 31 Oct 2014 18:00:12 +1100
From:	Michael Ellerman <mpe@...erman.id.au>
To:	Greg Kurz <gkurz@...ux.vnet.ibm.com>
Cc:	linux-kernel@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org,
	Herbert Xu <herbert@...dor.apana.org.au>,
	stable@...r.kernel.org
Subject: Re: [PATCH] hwrng: pseries - port to new read API and fix stack
 corruption

On Fri, 2014-10-31 at 07:50 +0100, Greg Kurz wrote:
> The add_early_randomness() function in drivers/char/hw_random/core.c passes
> a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
> returns four 64-bit values and trashes 16 bytes on the stack.

Hmm, thanks. I thought I'd fixed that, but I guess I never sent the patch :}

> This bug has been lying around for a long time. It got unveiled by:
> 
> commit d3cc7996473a7bdd33256029988ea690754e4e2a
> Author: Amit Shah <amit.shah@...hat.com>
> Date:   Thu Jul 10 15:42:34 2014 +0530
> 
>     hwrng: fetch randomness only after device init
> 
> It may trig a oops while loading or unloading the pseries-rng module for both
> PowerVM and PowerKVM guests.
> 
> This patch does two things:
> - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
>   since we're not on a hot path.

Well probably, can you do a before and after test of dd if=/dev/hwrng ?

> Cc'ing stable as I could reproduce back to 3.15.10

The right way to CC stable for a patch that isn't yet in upstream is to add:

CC: stable@...r.kernel.org

Before your Signed-off-by. They will then pick it up once it's merged into
Linus' tree. See Documentation/stable_kernel_rules.txt

cheers


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/