lkml.org 
[lkml]   [2022]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 025/264] random: fix data race on crng_node_pool
    Date
    From: Eric Biggers <ebiggers@google.com>

    commit 5d73d1e320c3fd94ea15ba5f79301da9a8bcc7de upstream.

    extract_crng() and crng_backtrack_protect() load crng_node_pool with a
    plain load, which causes undefined behavior if do_numa_crng_init()
    modifies it concurrently.

    Fix this by using READ_ONCE(). Note: as per the previous discussion
    https://lore.kernel.org/lkml/20211219025139.31085-1-ebiggers@kernel.org/T/#u,
    READ_ONCE() is believed to be sufficient here, and it was requested that
    it be used here instead of smp_load_acquire().

    Also change do_numa_crng_init() to set crng_node_pool using
    cmpxchg_release() instead of mb() + cmpxchg(), as the former is
    sufficient here but is more lightweight.

    Fixes: 1e7f583af67b ("random: make /dev/urandom scalable for silly userspace programs")
    Cc: stable@vger.kernel.org
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Acked-by: Paul E. McKenney <paulmck@kernel.org>
    Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/char/random.c | 22 ++++++++++++++++++++--
    1 file changed, 20 insertions(+), 2 deletions(-)

    --- a/drivers/char/random.c
    +++ b/drivers/char/random.c
    @@ -814,8 +814,8 @@ static void do_numa_crng_init(struct wor
    crng_initialize(crng);
    pool[i] = crng;
    }
    - mb();
    - if (cmpxchg(&crng_node_pool, NULL, pool)) {
    + /* pairs with READ_ONCE() in select_crng() */
    + if (cmpxchg_release(&crng_node_pool, NULL, pool) != NULL) {
    for_each_node(i)
    kfree(pool[i]);
    kfree(pool);
    @@ -828,8 +828,26 @@ static void numa_crng_init(void)
    {
    schedule_work(&numa_crng_init_work);
    }
    +
    +static struct crng_state *select_crng(void)
    +{
    + struct crng_state **pool;
    + int nid = numa_node_id();
    +
    + /* pairs with cmpxchg_release() in do_numa_crng_init() */
    + pool = READ_ONCE(crng_node_pool);
    + if (pool && pool[nid])
    + return pool[nid];
    +
    + return &primary_crng;
    +}
    #else
    static void numa_crng_init(void) {}
    +
    +static struct crng_state *select_crng(void)
    +{
    + return &primary_crng;
    +}
    #endif

    /*

    \
     
     \ /
      Last update: 2022-06-23 18:48    [W:4.272 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site