mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-04-03 12:05:13 +02:00
d5b7730f06
[ Upstream commitcc2f39d6ac] Currently, hwrng_fill is not cleared until the hwrng_fillfn() thread exits. Since hwrng_unregister() reads hwrng_fill outside the rng_mutex lock, a concurrent hwrng_unregister() may call kthread_stop() again on the same task. Additionally, if hwrng_unregister() is called immediately after hwrng_register(), the stopped thread may have never been executed. Thus, hwrng_fill remains dirty even after hwrng_unregister() returns. In this case, subsequent calls to hwrng_register() will fail to start new threads, and hwrng_unregister() will call kthread_stop() on the same freed task. In both cases, a use-after-free occurs: refcount_t: addition on 0; use-after-free. WARNING: ... at lib/refcount.c:25 refcount_warn_saturate+0xec/0x1c0 Call Trace: kthread_stop+0x181/0x360 hwrng_unregister+0x288/0x380 virtrng_remove+0xe3/0x200 This patch fixes the race by protecting the global hwrng_fill pointer inside the rng_mutex lock, so that hwrng_fillfn() thread is stopped only once, and calls to kthread_run() and kthread_stop() are serialized with the lock held. To avoid deadlock in hwrng_fillfn() while being stopped with the lock held, we convert current_rng to RCU, so that get_current_rng() can read current_rng without holding the lock. To remove the lock from put_rng(), we also delay the actual cleanup into a work_struct. Since get_current_rng() no longer returns ERR_PTR values, the IS_ERR() checks are removed from its callers. With hwrng_fill protected by the rng_mutex lock, hwrng_fillfn() can no longer clear hwrng_fill itself. Therefore, if hwrng_fillfn() returns directly after current_rng is dropped, kthread_stop() would be called on a freed task_struct later. To fix this, hwrng_fillfn() calls schedule() now to keep the task alive until being stopped. The kthread_stop() call is also moved from hwrng_unregister() to drop_current_rng(), ensuring kthread_stop() is called on all possible paths where current_rng becomes NULL, so that the thread would not wait forever. Fixes:be4000bc46("hwrng: create filler thread") Suggested-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Lianjie Wang <karin0.zst@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal@kernel.org>
70 lines
2.3 KiB
C
70 lines
2.3 KiB
C
/*
|
|
Hardware Random Number Generator
|
|
|
|
Please read Documentation/admin-guide/hw_random.rst for details on use.
|
|
|
|
----------------------------------------------------------
|
|
This software may be used and distributed according to the terms
|
|
of the GNU General Public License, incorporated herein by reference.
|
|
|
|
*/
|
|
|
|
#ifndef LINUX_HWRANDOM_H_
|
|
#define LINUX_HWRANDOM_H_
|
|
|
|
#include <linux/completion.h>
|
|
#include <linux/kref.h>
|
|
#include <linux/types.h>
|
|
#include <linux/workqueue_types.h>
|
|
|
|
/**
|
|
* struct hwrng - Hardware Random Number Generator driver
|
|
* @name: Unique RNG name.
|
|
* @init: Initialization callback (can be NULL).
|
|
* @cleanup: Cleanup callback (can be NULL).
|
|
* @data_present: Callback to determine if data is available
|
|
* on the RNG. If NULL, it is assumed that
|
|
* there is always data available. *OBSOLETE*
|
|
* @data_read: Read data from the RNG device.
|
|
* Returns the number of lower random bytes in "data".
|
|
* Must not be NULL. *OBSOLETE*
|
|
* @read: New API. drivers can fill up to max bytes of data
|
|
* into the buffer. The buffer is aligned for any type
|
|
* and max is a multiple of 4 and >= 32 bytes.
|
|
* @priv: Private data, for use by the RNG driver.
|
|
* @quality: Estimation of true entropy in RNG's bitstream
|
|
* (in bits of entropy per 1024 bits of input;
|
|
* valid values: 1 to 1024, or 0 for maximum).
|
|
*/
|
|
struct hwrng {
|
|
const char *name;
|
|
int (*init)(struct hwrng *rng);
|
|
void (*cleanup)(struct hwrng *rng);
|
|
int (*data_present)(struct hwrng *rng, int wait);
|
|
int (*data_read)(struct hwrng *rng, u32 *data);
|
|
int (*read)(struct hwrng *rng, void *data, size_t max, bool wait);
|
|
unsigned long priv;
|
|
unsigned short quality;
|
|
|
|
/* internal. */
|
|
struct list_head list;
|
|
struct kref ref;
|
|
struct work_struct cleanup_work;
|
|
struct completion cleanup_done;
|
|
struct completion dying;
|
|
};
|
|
|
|
struct device;
|
|
|
|
/** Register a new Hardware Random Number Generator driver. */
|
|
extern int hwrng_register(struct hwrng *rng);
|
|
extern int devm_hwrng_register(struct device *dev, struct hwrng *rng);
|
|
/** Unregister a Hardware Random Number Generator driver. */
|
|
extern void hwrng_unregister(struct hwrng *rng);
|
|
extern void devm_hwrng_unregister(struct device *dve, struct hwrng *rng);
|
|
|
|
extern long hwrng_msleep(struct hwrng *rng, unsigned int msecs);
|
|
extern long hwrng_yield(struct hwrng *rng);
|
|
|
|
#endif /* LINUX_HWRANDOM_H_ */
|