Commit 43838a23 authored by Theodore Ts'o's avatar Theodore Ts'o

random: fix crng_ready() test

The crng_init variable has three states:

0: The CRNG is not initialized at all
1: The CRNG has a small amount of entropy, hopefully good enough for
   early-boot, non-cryptographical use cases
2: The CRNG is fully initialized and we are sure it is safe for
   cryptographic use cases.

The crng_ready() function should only return true once we are in the
last state.  This addresses CVE-2018-1108.
Reported-by: default avatarJann Horn <jannh@google.com>
Fixes: e192be9d ("random: replace non-blocking pool...")
Cc: stable@kernel.org # 4.8+
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Reviewed-by: default avatarJann Horn <jannh@google.com>
parent 5e747dd9
...@@ -427,7 +427,7 @@ struct crng_state primary_crng = { ...@@ -427,7 +427,7 @@ struct crng_state primary_crng = {
* its value (from 0->1->2). * its value (from 0->1->2).
*/ */
static int crng_init = 0; static int crng_init = 0;
#define crng_ready() (likely(crng_init > 0)) #define crng_ready() (likely(crng_init > 1))
static int crng_init_cnt = 0; static int crng_init_cnt = 0;
#define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE) #define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE)
static void _extract_crng(struct crng_state *crng, static void _extract_crng(struct crng_state *crng,
...@@ -794,7 +794,7 @@ static int crng_fast_load(const char *cp, size_t len) ...@@ -794,7 +794,7 @@ static int crng_fast_load(const char *cp, size_t len)
if (!spin_trylock_irqsave(&primary_crng.lock, flags)) if (!spin_trylock_irqsave(&primary_crng.lock, flags))
return 0; return 0;
if (crng_ready()) { if (crng_init != 0) {
spin_unlock_irqrestore(&primary_crng.lock, flags); spin_unlock_irqrestore(&primary_crng.lock, flags);
return 0; return 0;
} }
...@@ -856,7 +856,7 @@ static void _extract_crng(struct crng_state *crng, ...@@ -856,7 +856,7 @@ static void _extract_crng(struct crng_state *crng,
{ {
unsigned long v, flags; unsigned long v, flags;
if (crng_init > 1 && if (crng_ready() &&
time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL)) time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL))
crng_reseed(crng, crng == &primary_crng ? &input_pool : NULL); crng_reseed(crng, crng == &primary_crng ? &input_pool : NULL);
spin_lock_irqsave(&crng->lock, flags); spin_lock_irqsave(&crng->lock, flags);
...@@ -1139,7 +1139,7 @@ void add_interrupt_randomness(int irq, int irq_flags) ...@@ -1139,7 +1139,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
fast_mix(fast_pool); fast_mix(fast_pool);
add_interrupt_bench(cycles); add_interrupt_bench(cycles);
if (!crng_ready()) { if (unlikely(crng_init == 0)) {
if ((fast_pool->count >= 64) && if ((fast_pool->count >= 64) &&
crng_fast_load((char *) fast_pool->pool, crng_fast_load((char *) fast_pool->pool,
sizeof(fast_pool->pool))) { sizeof(fast_pool->pool))) {
...@@ -2212,7 +2212,7 @@ void add_hwgenerator_randomness(const char *buffer, size_t count, ...@@ -2212,7 +2212,7 @@ void add_hwgenerator_randomness(const char *buffer, size_t count,
{ {
struct entropy_store *poolp = &input_pool; struct entropy_store *poolp = &input_pool;
if (!crng_ready()) { if (unlikely(crng_init == 0)) {
crng_fast_load(buffer, count); crng_fast_load(buffer, count);
return; return;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment