Herbert Xu 26cc6d7006 hwrng: core - Fix page fault dead lock on mmap-ed hwrng ...

commit 78aafb3884 upstream.

There is a dead-lock in the hwrng device read path.  This triggers
when the user reads from /dev/hwrng into memory also mmap-ed from
/dev/hwrng.  The resulting page fault triggers a recursive read
which then dead-locks.

Fix this by using a stack buffer when calling copy_to_user.

Reported-by: Edward Adam Davis <eadavis@qq.com>
Reported-by: syzbot+c52ab18308964d248092@syzkaller.appspotmail.com
Fixes: 9996508b33 ("hwrng: core - Replace u32 in driver API with byte array")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-02-23 08:54:24 +01:00

..

agp

parisc: sba: Fix compile warning wrt list of SBA devices

2023-10-06 13:18:15 +02:00

hw_random

hwrng: core - Fix page fault dead lock on mmap-ed hwrng

2024-02-23 08:54:24 +01:00

ipmi

ipmi_si: fix a memleak in try_smi_init()

2023-09-19 12:22:50 +02:00

mwave

…

pcmcia

Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol"

2023-03-10 09:39:38 +01:00

tpm

tpm_tis: Resend command to recover from data transfer errors

2023-09-23 11:09:56 +02:00

xilinx_hwicap

…

xillybus

…

adi.c

…

apm-emulation.c

…

applicom.c

applicom: Fix PCI device refcount leak in applicom_init()

2023-03-10 09:39:38 +01:00

applicom.h

…

bsr.c

…

ds1620.c

…

dsp56k.c

…

dtlk.c

…

hangcheck-timer.c

…

hpet.c

…

Kconfig

…

lp.c

…

Makefile

…

mem.c

…

misc.c

…

mspec.c

…

nsc_gpio.c

…

nvram.c

…

nwbutton.c

…

nwbutton.h

…

nwflash.c

…

pc8736x_gpio.c

…

powernv-op-panel.c

…

ppdev.c

…

ps3flash.c

…

random.c

random: use expired timer rather than wq for mixing fast pool

2022-10-15 07:59:02 +02:00

scx200_gpio.c

…

sonypi.c

…

tb0219.c

…

tlclk.c

…

toshiba.c

…

ttyprintk.c

…

uv_mmtimer.c

…

virtio_console.c

…