linux-kernel - Re: [RFC PATCH v1 36/50] random: Merge batched entropy buffers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 1 Apr 2020 21:11:04 +0000
From:   George Spelvin <lkml@....ORG>
To:     linux-kernel@...r.kernel.org, tytso@....edu
Cc:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>, lkml@....org
Subject: Re: [RFC PATCH v1 36/50] random: Merge batched entropy buffers

I just noticed a rather insidious bug in the preceding, so please
revoke my S-o-b.

Storing the batch position in the first byte works fine if it's
updated very late in get_random_uXX(), after the random value is
read from a refilled batch.  The first few versions of my code
did this.

But then I discovered the "xor trick" to handle unaligned reads
and it hugely simplfiied the code.  It simplified it so much that
the unaligned position wasn't needed much; only to compute the
aligned position.

While squashing together the various revisions to this code, I
moved the write-back of the position earlier in the code..  Which
violates the requirement stated in paragraph 2.  :-(

There are several possible fixes, but the simplest is to move
the "u8 position;" down a couple of lines, out of the union.
Since the following patch reduces the lock to a single byte,
there's room in the structure without increasing its size.

Revised patch will follow.