alex/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hwrng: core - Add WARN_ON for buggy read return values

Browse Source 
If a buggy driver returns a length that is longer than the size
of the buffer provided to it, then this may lead to a buffer overread
in the caller.

Stop this by adding a check for it in the hwrng core.

Reported-by: Guangwu Zhang <guazhang@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Herbert Xu 2024-09-23 14:05:52 +08:00
parent 98091a8268
commit fb10c7a846
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/char/hw_random/core.c
View File

@ -181,8 +181,15 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
int present;
BUG_ON(!mutex_is_locked(&reading_mutex));
if (rng->read)
return rng->read(rng, (void *)buffer, size, wait);
if (rng->read) {
int err;
err = rng->read(rng, buffer, size, wait);
if (WARN_ON_ONCE(err > 0 && err > size))
err = size;
return err;
}
if (rng->data_present)
present = rng->data_present(rng, wait);