linux-kernel - Re: [PATCH] random: do not use jump labels before they are initialized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yp8rcFrqK/IkzKXj@zx2c4.com>
Date:   Tue, 7 Jun 2022 12:41:52 +0200
From:   "Jason A. Donenfeld" <Jason@...c4.com>
To:     Ard Biesheuvel <ardb@...nel.org>
Cc:     linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        Stephen Boyd <swboyd@...omium.org>,
        Catalin Marinas <catalin.marinas@....com>,
        Russell King <linux@...linux.org.uk>,
        Arnd Bergmann <arnd@...db.de>,
        Phil Elwell <phil@...pberrypi.com>
Subject: Re: [PATCH] random: do not use jump labels before they are
 initialized

Hey again,

On Tue, Jun 07, 2022 at 12:28:08PM +0200, Jason A. Donenfeld wrote:
> Hi Ard,
> 
> On Tue, Jun 07, 2022 at 12:13:29PM +0200, Ard Biesheuvel wrote:
> > Hi Jason,
> > 
> > On Tue, 7 Jun 2022 at 12:04, Jason A. Donenfeld <Jason@...c4.com> wrote:
> > >
> > > [ I would like to pursue fixing this more directly first before actually
> > >   merging this, but I thought I'd send this to the list now anyway as a
> > >   the "backup" plan. If I can't figure out how to make headway on the
> > >   main plan in the next few days, it'll be easy to just do this. ]
> > >
> > 
> > What more direct fix did you have in mind here?
> 
> A non-broken version of https://lore.kernel.org/lkml/20220603121543.360283-1-Jason@zx2c4.com/
> 
> As I mentioned in https://lore.kernel.org/lkml/Yp8kQrBgE3WVqqC5@zx2c4.com/ ,
> 
>     I would like a few days to see if there's some trivial way of not
>     needing that on arm32. If it turns out to be easy, then I'd prefer the
>     direct fix akin to the arm64 one. If it turns out to be not easy, then
>     I'll merge the backup commit.
> 
> > > diff --git a/drivers/char/random.c b/drivers/char/random.c
> > > index 4862d4d3ec49..f9a020ec08b9 100644
> > > --- a/drivers/char/random.c
> > > +++ b/drivers/char/random.c
> > > @@ -650,7 +650,8 @@ static void __cold _credit_init_bits(size_t bits)
> > >
> > >         if (orig < POOL_READY_BITS && new >= POOL_READY_BITS) {
> > >                 crng_reseed(); /* Sets crng_init to CRNG_READY under base_crng.lock. */
> > > -               execute_in_process_context(crng_set_ready, &set_ready);
> > > +               if (static_key_initialized)
> > > +                       execute_in_process_context(crng_set_ready, &set_ready);
> > 
> > Can we just drop this entirely, and rely on the hunk below to set the
> > static key? What justifies having two code paths that set the static
> > key in different ways on different architectures?
> 
> No, we can't. The hunk below (A) is called from init/main.c some time after
> jump_label_init(). The hunk above (B) is called whenever we reach the
> 256-bit mark.
> 
> The order is (B)(A) on machines that get seeded from efi or device tree.
> The order is (A)(B) on all other machines, which reach the 256-bit mark
> at "some point"... could be after a second, a minute, whenever enough
> estimated entropy has been accounted.

Just thinking about this a bit more, I should note that this is not the
first problem caused by EFI/DT doing its thing mega early in the boot
process. Dominik and I fixed up what felt like endless bugs all of
basically that same form back in January. Before it mostly had to do
with workqueues not being available yet. Now it has to do with jump
labels.

So in thinking about how to fix this, the two approaches thus far
discussed are:

1. initialize jump labels earlier, e.g. the arm64 patch (and proposed
   arm32 patch).
2. defer the static key enabling until later, e.g. this patch.

As a third, I could just defer doing anything with the bootloader seed
until random_init(). This might actually be the simplest solution...
I'll sketch something out. A downside, which might be sort of
significant, is that a few odd things actually use randomness before
random_init() is called. So these would miss out on having that seed.
I'll have to look what exactly to see if we're actually getting anything
real out of that.

Jason