From: Herbert Xu <herbert@gondor.apana.org.au>
To: Laurent Vivier <lvivier@redhat.com>
Cc: linux-kernel@vger.kernel.org, Matt Mackall <mpm@selenic.com>,
'Linux Samsung SOC' <linux-samsung-soc@vger.kernel.org>,
Marek Szyprowski <m.szyprowski@samsung.com>,
linux-crypto@vger.kernel.org
Subject: Re: [PATCH] hwrng: core - Fix use-after-free warning in hwrng_register()
Date: Fri, 18 Oct 2019 19:06:42 +1100 [thread overview]
Message-ID: <20191018080642.GN25128@gondor.apana.org.au> (raw)
In-Reply-To: <20191014114632.10875-1-lvivier@redhat.com>
On Mon, Oct 14, 2019 at 01:46:32PM +0200, Laurent Vivier wrote:
> Commit daae28debcb0 has moved add_early_randomness() out of the
> rng_mutex and tries to protect the reference of the new rng device
> by incrementing the reference counter.
>
> But in hwrng_register(), the function can be called with a new device
> that is not set as the current_rng device and the reference has not been
> initialized. This patch fixes the problem by not using the reference
> counter when the device is not the current one: the reference counter
> is only meaningful in the case of the current rng device and a device
> is not used if it is not the current one (except in hwrng_register())
>
> The problem has been reported by Marek Szyprowski on ARM 32bit
> Exynos5420-based Chromebook Peach-Pit board:
>
> WARNING: CPU: 3 PID: 1 at lib/refcount.c:156 hwrng_register+0x13c/0x1b4
> refcount_t: increment on 0; use-after-free.
> Modules linked in:
> CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.4.0-rc1-00061-gdaae28debcb0
> Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
> [<c01124c8>] (unwind_backtrace) from [<c010dfb8>] (show_stack+0x10/0x14)
> [<c010dfb8>] (show_stack) from [<c0ae86d8>] (dump_stack+0xa8/0xd4)
> [<c0ae86d8>] (dump_stack) from [<c0127428>] (__warn+0xf4/0x10c)
> [<c0127428>] (__warn) from [<c01274b4>] (warn_slowpath_fmt+0x74/0xb8)
> [<c01274b4>] (warn_slowpath_fmt) from [<c054729c>] (hwrng_register+0x13c/0x1b4)
> [<c054729c>] (hwrng_register) from [<c0547e54>] (tpm_chip_register+0xc4/0x274)
> ...
>
> Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Fixes: daae28debcb0 ("hwrng: core - move add_early_randomness() out of rng_mutex")
> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Signed-off-by: Laurent Vivier <lvivier@redhat.com>
> ---
> drivers/char/hw_random/core.c | 33 ++++++++++++++++-----------------
> 1 file changed, 16 insertions(+), 17 deletions(-)
Patch applied. Thanks.
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
prev parent reply other threads:[~2019-10-18 8:07 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-14 11:46 [PATCH] hwrng: core - Fix use-after-free warning in hwrng_register() Laurent Vivier
2019-10-18 8:06 ` Herbert Xu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191018080642.GN25128@gondor.apana.org.au \
--to=herbert@gondor.apana.org.au \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-samsung-soc@vger.kernel.org \
--cc=lvivier@redhat.com \
--cc=m.szyprowski@samsung.com \
--cc=mpm@selenic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).