linux-kernel - Re: [PATCH] fault-inject: use prandom where cryptographically secure randomness is not needed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20241209115221.GO21636@noisy.programming.kicks-ass.net>
Date: Mon, 9 Dec 2024 12:52:21 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: Akinobu Mita <akinobu.mita@...il.com>
Cc: linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
	Masami Hiramatsu <mhiramat@...nel.org>
Subject: Re: [PATCH] fault-inject: use prandom where cryptographically secure
 randomness is not needed

On Sun, Dec 08, 2024 at 11:24:15PM +0900, Akinobu Mita wrote:
> Currently get_random*() is used to determine the probability of fault
> injection, but cryptographically secure random numbers are not required.
> 
> There is no big problem in using prandom instead of get_random*() to
> determine the probability of fault injection, and it also avoids acquiring
> a spinlock, which is unsafe in some contexts.
> 
> Link: https://lore.kernel.org/lkml/20241129120939.GG35539@noisy.programming.kicks-ass.net
> Suggested-by: Peter Zijlstra <peterz@...radead.org>
> Signed-off-by: Akinobu Mita <akinobu.mita@...il.com>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: Masami Hiramatsu <mhiramat@...nel.org>
> ---
>  lib/fault-inject.c | 28 ++++++++++++++++++++++++++--
>  1 file changed, 26 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/fault-inject.c b/lib/fault-inject.c
> index 52eb6ba29698..92a54c8a8380 100644
> --- a/lib/fault-inject.c
> +++ b/lib/fault-inject.c
> @@ -1,7 +1,7 @@
>  // SPDX-License-Identifier: GPL-2.0-only
>  #include <linux/kernel.h>
>  #include <linux/init.h>
> -#include <linux/random.h>
> +#include <linux/prandom.h>
>  #include <linux/debugfs.h>
>  #include <linux/sched.h>
>  #include <linux/stat.h>
> @@ -12,6 +12,24 @@
>  #include <linux/stacktrace.h>
>  #include <linux/fault-inject.h>
>  
> +/*
> + * The should_fail() use prandom instead of the normal Linux RNG since they don't
> + * need cryptographically secure random numbers.
> + */
> +static DEFINE_PER_CPU(struct rnd_state, fault_rnd_state);
> +
> +static u32 fault_prandom_u32_below_100(void)
> +{
> +	struct rnd_state *state;
> +	u32 res;
> +
> +	state = &get_cpu_var(fault_rnd_state);
> +	res = prandom_u32_state(state);
> +	put_cpu_var(fault_rnd_state);
> +
> +	return res % 100;

This is a bit unfortunate, the remainder function is not uniform (for
non-powers-of-two). I mean, nobody cares, and certainly here it doesn't
matter, but *groan*.

The problem seems to be that this ->probability thing used throughout
this code seems to be a percentage, while typically the probability is
expressed as a real number between 0 and 1.

<rant> For reasons not understood by me, and probably related to education
systems, some people think percentages are 'special' and not just a
1/100 fraction. </rant>

I feel this code would be improved if instead of a percentage value, the
probability would be represented as a fixed point value 0<=p<=1 with a
power-of-two base.

Eg. attr->probability = 1024*probability/100;

> +}
> +
>  /*
>   * setup_fault_attr() is a helper function for various __setup handlers, so it
>   * returns 0 on error, because that is what __setup handlers do.
> @@ -31,6 +49,8 @@ int setup_fault_attr(struct fault_attr *attr, char *str)
>  		return 0;
>  	}
>  
> +	prandom_init_once(&fault_rnd_state);
> +
>  	attr->probability = probability;
>  	attr->interval = interval;
>  	atomic_set(&attr->times, times);
> @@ -146,7 +166,7 @@ bool should_fail_ex(struct fault_attr *attr, ssize_t size, int flags)
>  			return false;
>  	}
>  
> -	if (attr->probability <= get_random_u32_below(100))
> +	if (attr->probability <= fault_prandom_u32_below_100())
>  		return false;
>  
>  fail:
> @@ -219,6 +239,8 @@ struct dentry *fault_create_debugfs_attr(const char *name,
>  	if (IS_ERR(dir))
>  		return dir;
>  
> +	prandom_init_once(&fault_rnd_state);
> +
>  	debugfs_create_ul("probability", mode, dir, &attr->probability);
>  	debugfs_create_ul("interval", mode, dir, &attr->interval);
>  	debugfs_create_atomic_t("times", mode, dir, &attr->times);
> @@ -431,6 +453,8 @@ static const struct config_item_type fault_config_type = {
>  
>  void fault_config_init(struct fault_config *config, const char *name)
>  {
> +	prandom_init_once(&fault_rnd_state);
> +
>  	config_group_init_type_name(&config->group, name, &fault_config_type);
>  }
>  EXPORT_SYMBOL_GPL(fault_config_init);

Anyway, yes, this cures the random problem. Thanks!

Acked-by: Peter Zijlstra (Intel) <peterz@...radead.org>