linux-kernel - Re: [PATCH v4] hwrng: core - use RCU and work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aYXJvmJGIMLgCOKx@gondor.apana.org.au>
Date: Fri, 6 Feb 2026 19:00:14 +0800
From: Herbert Xu <herbert@...dor.apana.org.au>
To: Lianjie Wang <karin0.zst@...il.com>
Cc: Olivia Mackall <olivia@...enic.com>,
	David Laight <david.laight.linux@...il.com>,
	Jonathan McDowell <noodles@...a.com>, linux-crypto@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4] hwrng: core - use RCU and work_struct to fix race
 condition

On Fri, Jan 30, 2026 at 06:50:16AM +0900, Lianjie Wang wrote:
> Currently, hwrng_fill is not cleared until the hwrng_fillfn() thread
> exits. Since hwrng_unregister() reads hwrng_fill outside the rng_mutex
> lock, a concurrent hwrng_unregister() may call kthread_stop() again on
> the same task.
> 
> Additionally, if hwrng_unregister() is called immediately after
> hwrng_register(), the stopped thread may have never been executed. Thus,
> hwrng_fill remains dirty even after hwrng_unregister() returns. In this
> case, subsequent calls to hwrng_register() will fail to start new
> threads, and hwrng_unregister() will call kthread_stop() on the same
> freed task. In both cases, a use-after-free occurs:
> 
> refcount_t: addition on 0; use-after-free.
> WARNING: ... at lib/refcount.c:25 refcount_warn_saturate+0xec/0x1c0
> Call Trace:
>  kthread_stop+0x181/0x360
>  hwrng_unregister+0x288/0x380
>  virtrng_remove+0xe3/0x200
> 
> This patch fixes the race by protecting the global hwrng_fill pointer
> inside the rng_mutex lock, so that hwrng_fillfn() thread is stopped only
> once, and calls to kthread_run() and kthread_stop() are serialized
> with the lock held.
> 
> To avoid deadlock in hwrng_fillfn() while being stopped with the lock
> held, we convert current_rng to RCU, so that get_current_rng() can read
> current_rng without holding the lock. To remove the lock from put_rng(),
> we also delay the actual cleanup into a work_struct.
> 
> Since get_current_rng() no longer returns ERR_PTR values, the IS_ERR()
> checks are removed from its callers.
> 
> With hwrng_fill protected by the rng_mutex lock, hwrng_fillfn() can no
> longer clear hwrng_fill itself. Therefore, if hwrng_fillfn() returns
> directly after current_rng is dropped, kthread_stop() would be called on
> a freed task_struct later. To fix this, hwrng_fillfn() calls schedule()
> now to keep the task alive until being stopped. The kthread_stop() call
> is also moved from hwrng_unregister() to drop_current_rng(), ensuring
> kthread_stop() is called on all possible paths where current_rng becomes
> NULL, so that the thread would not wait forever.
> 
> Fixes: be4000bc4644 ("hwrng: create filler thread")
> Suggested-by: Herbert Xu <herbert@...dor.apana.org.au>
> Signed-off-by: Lianjie Wang <karin0.zst@...il.com>
> ---
> v4:
>  - Include linux/workqueue_types.h in hw_random.h, rather than
>    linux/workqueue.h.
>  - Include linux/workqueue.h in core.c.
> 
> v3: https://lore.kernel.org/linux-crypto/20260128221052.2141154-1-karin0.zst@gmail.com/
>  - Add work_struct to delay the cleanup and protect it with rng_mutex
>    again to avoid races with hwrng_init().
>  - Change the waiting loop in hwrng_fillfn() to match the pattern in
>    fs/ext4/mmp.c, and add comments for clarity.
>  - Change kref_get_unless_zero() back to a plain kref_get() in
>    get_current_rng().
>  - Move the NULL check back to put_rng().
> 
> v2: https://lore.kernel.org/linux-crypto/20260124195555.851117-1-karin0.zst@gmail.com/
>  - Convert the lock for get_current_rng() to RCU to break the deadlock, as
>    suggested by Herbert Xu.
>  - Remove rng_mutex from put_rng() and move NULL check to rng_current_show().
>  - Move kthread_stop() to drop_current_rng() inside the lock to join the task
>    on all paths, avoiding modifying hwrng_fill inside hwrng_fillfn().
>  - Revert changes to rng_fillbuf.
> 
> v1: https://lore.kernel.org/linux-crypto/20251221122448.246531-1-karin0.zst@gmail.com/
> 
>  drivers/char/hw_random/core.c | 168 +++++++++++++++++++++-------------
>  include/linux/hw_random.h     |   2 +
>  2 files changed, 107 insertions(+), 63 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt