[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZnDQ-HQH8NlmCcIr@zx2c4.com>
Date: Tue, 18 Jun 2024 02:12:40 +0200
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: Andy Lutomirski <luto@...capital.net>
Cc: linux-kernel@...r.kernel.org, patches@...ts.linux.dev,
tglx@...utronix.de, linux-crypto@...r.kernel.org,
linux-api@...r.kernel.org, x86@...nel.org,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Adhemerval Zanella Netto <adhemerval.zanella@...aro.org>,
Carlos O'Donell <carlos@...hat.com>,
Florian Weimer <fweimer@...hat.com>, Arnd Bergmann <arnd@...db.de>,
Jann Horn <jannh@...gle.com>,
Christian Brauner <brauner@...nel.org>,
David Hildenbrand <dhildenb@...hat.com>
Subject: Re: [PATCH v17 4/5] random: introduce generic vDSO getrandom()
implementation
Hi Andy,
On Mon, Jun 17, 2024 at 05:06:22PM -0700, Andy Lutomirski wrote:
> On Fri, Jun 14, 2024 at 12:08 PM Jason A. Donenfeld <Jason@...c4.com> wrote:
> >
> > Provide a generic C vDSO getrandom() implementation, which operates on
> > an opaque state returned by vgetrandom_alloc() and produces random bytes
> > the same way as getrandom(). This has a the API signature:
> >
> > ssize_t vgetrandom(void *buffer, size_t len, unsigned int flags, void *opaque_state);
>
> Last time around, I mentioned some potential issues with this function
> signature, and I didn't see any answer. My specific objection was to
> the fact that the caller passes in a pointer but not a length, and
> this potentially makes reasoning about memory safety awkward,
> especially if anything like CRIU is involved.
Oh, I understood this backwards last time - I thought you were
criticizing the size_t len argument, which didn't make any sense.
Re-reading now, what you're suggesting is that I add an additional
argument called `size_t opaque_len`, and then the implementation does
something like:
if (opaque_len != sizeof(struct vgetrandom_state))
goto fallback_syscall;
With the reasoning that falling back to syscall is better than returning
-EINVAL, because that could happen in a natural way due to CRIU. In
contrast, your objection to opaque_state not being aligned falling back
to the syscall was that it should never happen ever, so -EFAULT is more
fitting.
Is that correct?
If I've gotten you right this time, I'll add that argument as described.
Seems straight forward to do. It's a bit annoying from a libc
perspective, as the length has to be stored, but that's not impossible.
Jason
Powered by blists - more mailing lists