From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751374AbdJ2V5b (ORCPT ); Sun, 29 Oct 2017 17:57:31 -0400 Received: from imap.thunk.org ([74.207.234.97]:41512 "EHLO imap.thunk.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750764AbdJ2V5a (ORCPT ); Sun, 29 Oct 2017 17:57:30 -0400 Date: Sun, 29 Oct 2017 14:25:29 -0400 From: "Theodore Ts'o" To: Chen Feng Cc: Greg KH , zhaoyukun@huawei.com, arnd@arndb.de, linux-kernel@vger.kernel.org, suzhuangluan@hisilicon.com, dan.zhao@hisilicon.com Subject: Re: [PATCH RFC] random: fix syzkaller fuzzer test int overflow Message-ID: <20171029182529.rxmbawagx63e2dw4@thunk.org> Mail-Followup-To: Theodore Ts'o , Chen Feng , Greg KH , zhaoyukun@huawei.com, arnd@arndb.de, linux-kernel@vger.kernel.org, suzhuangluan@hisilicon.com, dan.zhao@hisilicon.com References: <1508831057-64195-1-git-send-email-puck.chen@hisilicon.com> <20171024090927.GA20625@kroah.com> <20171024102528.7oywdwjriesoh3mk@thunk.org> <59F02FA0.7090605@hisilicon.com> <20171025065646.GA13386@kroah.com> <59F03887.7020700@hisilicon.com> <20171025084926.mpdec34mog3xcocz@thunk.org> <59F19BEB.7090100@hisilicon.com> <20171026150445.s3rxcy4btlisdu5q@thunk.org> <59F3F7D8.1080807@hisilicon.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <59F3F7D8.1080807@hisilicon.com> User-Agent: NeoMutt/20170609 (1.8.3) X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: tytso@thunk.org X-SA-Exim-Scanned: No (on imap.thunk.org); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Oct 28, 2017 at 11:22:00AM +0800, Chen Feng wrote: > > I checked the ioctl. What's the purpose of RNDADDTOENTCNT ioctl to > userspace? It's a legacy ioctl which is probably not used anywhere; it's been replaced by RNDADDENTROPY. It previously allows root to bump the entropy estimate, but the right way to do this by rngd is to atomically add entropy to the pool land and bump the entropy estimate at the same time. The UBSAN is harmless. The ioctl requires root, and the entropy_total field, which is involved in the UBSAN, is only used in the first few seconds of boot, to determine when the entropy pool has been initialized. In general on desktop and servers this happens before userspace has a chance to run. In any case, here's a fix for this. - Ted commit 6f7034d0c52e21f30002b95126b6b98e4618dc57 Author: Theodore Ts'o Date: Sun Oct 29 14:17:26 2017 -0400 random: use a tighter cap in credit_entropy_bits_safe() This fixes a harmless UBSAN where root could potentially end up causing an overflow while bumping the entropy_total field (which is ignored once the entropy pool has been initialized, and this generally is completed during the boot sequence). This is marginal for the stable kernel series, but it's a really trivial patch, and it UBSAN warning that might cause security folks to get overly excited for no reason. Signed-off-by: Theodore Ts'o Cc: stable@vger.kernel.org diff --git a/drivers/char/random.c b/drivers/char/random.c index 8ad92707e45f..ae8a2f829890 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -733,7 +733,7 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits) static int credit_entropy_bits_safe(struct entropy_store *r, int nbits) { - const int nbits_max = (int)(~0U >> (ENTROPY_SHIFT + 1)); + const int nbits_max = r->poolinfo->poolwords * 32; if (nbits < 0) return -EINVAL;