mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-02-28 19:06:51 +01:00
cc2f39d6ac
Currently, hwrng_fill is not cleared until the hwrng_fillfn() thread
exits. Since hwrng_unregister() reads hwrng_fill outside the rng_mutex
lock, a concurrent hwrng_unregister() may call kthread_stop() again on
the same task.
Additionally, if hwrng_unregister() is called immediately after
hwrng_register(), the stopped thread may have never been executed. Thus,
hwrng_fill remains dirty even after hwrng_unregister() returns. In this
case, subsequent calls to hwrng_register() will fail to start new
threads, and hwrng_unregister() will call kthread_stop() on the same
freed task. In both cases, a use-after-free occurs:
refcount_t: addition on 0; use-after-free.
WARNING: ... at lib/refcount.c:25 refcount_warn_saturate+0xec/0x1c0
Call Trace:
kthread_stop+0x181/0x360
hwrng_unregister+0x288/0x380
virtrng_remove+0xe3/0x200
This patch fixes the race by protecting the global hwrng_fill pointer
inside the rng_mutex lock, so that hwrng_fillfn() thread is stopped only
once, and calls to kthread_run() and kthread_stop() are serialized
with the lock held.
To avoid deadlock in hwrng_fillfn() while being stopped with the lock
held, we convert current_rng to RCU, so that get_current_rng() can read
current_rng without holding the lock. To remove the lock from put_rng(),
we also delay the actual cleanup into a work_struct.
Since get_current_rng() no longer returns ERR_PTR values, the IS_ERR()
checks are removed from its callers.
With hwrng_fill protected by the rng_mutex lock, hwrng_fillfn() can no
longer clear hwrng_fill itself. Therefore, if hwrng_fillfn() returns
directly after current_rng is dropped, kthread_stop() would be called on
a freed task_struct later. To fix this, hwrng_fillfn() calls schedule()
now to keep the task alive until being stopped. The kthread_stop() call
is also moved from hwrng_unregister() to drop_current_rng(), ensuring
kthread_stop() is called on all possible paths where current_rng becomes
NULL, so that the thread would not wait forever.
Fixes: be4000bc46 ("hwrng: create filler thread")
Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Lianjie Wang <karin0.zst@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
70 lines
2.3 KiB
C
70 lines
2.3 KiB
C
/*
|
|
Hardware Random Number Generator
|
|
|
|
Please read Documentation/admin-guide/hw_random.rst for details on use.
|
|
|
|
----------------------------------------------------------
|
|
This software may be used and distributed according to the terms
|
|
of the GNU General Public License, incorporated herein by reference.
|
|
|
|
*/
|
|
|
|
#ifndef LINUX_HWRANDOM_H_
|
|
#define LINUX_HWRANDOM_H_
|
|
|
|
#include <linux/completion.h>
|
|
#include <linux/kref.h>
|
|
#include <linux/types.h>
|
|
#include <linux/workqueue_types.h>
|
|
|
|
/**
|
|
* struct hwrng - Hardware Random Number Generator driver
|
|
* @name: Unique RNG name.
|
|
* @init: Initialization callback (can be NULL).
|
|
* @cleanup: Cleanup callback (can be NULL).
|
|
* @data_present: Callback to determine if data is available
|
|
* on the RNG. If NULL, it is assumed that
|
|
* there is always data available. *OBSOLETE*
|
|
* @data_read: Read data from the RNG device.
|
|
* Returns the number of lower random bytes in "data".
|
|
* Must not be NULL. *OBSOLETE*
|
|
* @read: New API. drivers can fill up to max bytes of data
|
|
* into the buffer. The buffer is aligned for any type
|
|
* and max is a multiple of 4 and >= 32 bytes.
|
|
* @priv: Private data, for use by the RNG driver.
|
|
* @quality: Estimation of true entropy in RNG's bitstream
|
|
* (in bits of entropy per 1024 bits of input;
|
|
* valid values: 1 to 1024, or 0 for maximum).
|
|
*/
|
|
struct hwrng {
|
|
const char *name;
|
|
int (*init)(struct hwrng *rng);
|
|
void (*cleanup)(struct hwrng *rng);
|
|
int (*data_present)(struct hwrng *rng, int wait);
|
|
int (*data_read)(struct hwrng *rng, u32 *data);
|
|
int (*read)(struct hwrng *rng, void *data, size_t max, bool wait);
|
|
unsigned long priv;
|
|
unsigned short quality;
|
|
|
|
/* internal. */
|
|
struct list_head list;
|
|
struct kref ref;
|
|
struct work_struct cleanup_work;
|
|
struct completion cleanup_done;
|
|
struct completion dying;
|
|
};
|
|
|
|
struct device;
|
|
|
|
/** Register a new Hardware Random Number Generator driver. */
|
|
extern int hwrng_register(struct hwrng *rng);
|
|
extern int devm_hwrng_register(struct device *dev, struct hwrng *rng);
|
|
/** Unregister a Hardware Random Number Generator driver. */
|
|
extern void hwrng_unregister(struct hwrng *rng);
|
|
extern void devm_hwrng_unregister(struct device *dve, struct hwrng *rng);
|
|
|
|
extern long hwrng_msleep(struct hwrng *rng, unsigned int msecs);
|
|
extern long hwrng_yield(struct hwrng *rng);
|
|
|
|
#endif /* LINUX_HWRANDOM_H_ */
|