linux-kernel - Re: [PATCH] random: make try_to_generate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.21.1910191211410.2098@nanos.tec.linutronix.de>
Date:   Sat, 19 Oct 2019 12:13:53 +0200 (CEST)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Ingo Molnar <mingo@...nel.org>
cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Jörn Engel <joern@...estorage.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] random: make try_to_generate_entropy() more robust

On Sat, 19 Oct 2019, Ingo Molnar wrote:
> * Linus Torvalds <torvalds@...ux-foundation.org> wrote:
> > On Fri, Oct 18, 2019 at 4:42 PM Jörn Engel <joern@...estorage.com> wrote:
> 
> But from a softirq or threaded irq context that 'interrupted' regs 
> context might potentially be NULL.
> 
> NULL isn't a good thing to pass to mix_pool_bytes(), because the first 
> use of 'in' (='bytes') in _mix_pool_bytes() is a dereference without a 
> NULL check AFAICS:
> 
>                 w = rol32(*bytes++, input_rotate);
> 
> So at minimum I'd only mix this entropy into the pool if 'regs' is 
> non-zero. This would automatically do the right thing and not crash the 
> kernel on weird irq execution models such as threaded-only or -rt.

You don't even need threaded-only or RT. The timer is fired in the softirq
which very well can happen from thread context in mainline.

Thanks,

	tglx