lkml.org 
[lkml]   [2022]   [Feb]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: BUG: KCSAN: data-race in add_device_randomness+0x20d/0x290
    On Mon, Feb 7, 2022 at 10:50 PM Jann Horn <jannh@google.com> wrote:
    >
    > On Mon, Feb 7, 2022 at 10:45 PM Jann Horn <jannh@google.com> wrote:
    > > On Mon, Feb 7, 2022 at 7:42 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
    > > > Thanks for the report. I assume that this is actually an old bug. Do
    > > > you have a vmlinux or a random.o from this kernel you could send me to
    > > > double check? Without that, my best guess, which I'd say I have
    > > > relatively high confidence about, is that the "1 byte read" is
    > > > actually a `movzx eax, cs:lfsr` referring to the `static u8 lfsr`
    > > > here, which gets inlined into add_device_randomness:
    > > >
    > > > static int crng_slow_load(const u8 *cp, size_t len)
    > > > {
    > > > unsigned long flags;
    > > > static u8 lfsr = 1;
    > > >
    > > > This was added in 2008 with dc12baacb95f ("random: use a different
    > > > mixing algorithm for add_device_randomness()"). My understanding is
    > > > that the race here isn't super problematic as we're in kind of a half
    > > > assed "low effort" phase anyway. But I'll give it some thought. I'm
    > > > CCing Jann as well who reported the original issue that motivated that
    > > > change.
    > >
    > > But the "lfsr" variable is never accessed outside the part of this
    > > method that holds a global spinlock. So that can't really be it,
    > > right?
    >
    > There is a data race in crng_ready(), it just loads from "crng_init"
    > without READ_ONCE()... maybe that's what KCSAN is noticing?

    (Actually, maybe it should technically even be a smp_load_acquire()?
    Or do we have anything else that ensures that we can't get ordering
    issues here?)

    \
     
     \ /
      Last update: 2022-02-07 22:55    [W:4.194 / U:1.560 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site