From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com [209.85.221.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A55723C0601 for ; Tue, 19 May 2026 20:48:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779223703; cv=none; b=RCBkFAHrHynpyuJIfk/NOwvH/A3ZO3MtariQonTzDtWhGAIxz3cTkep2PlmjtsJqvMoPH+SWAcLEmG3SGlPU/GFOWxWF3mb+0M3VZIyZLjKbeHMcajcUtzI1kPwDwWbpKwb41dKxATGvt1xWSLy+Co8XFDmo3jGXUGzRn1sNI1A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779223703; c=relaxed/simple; bh=HcGNt0IMVlN/ojuZul68gyUXfj92IbH1U64eeoIpt3w=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ozzstaX29PFpy/dJqH63aKPgtuEp4vjUc8r1lP0EgHd+Pnb68ojrObf3lZ1bkodsvZFDpU1GJUxEbhUpOOtmbeHx/T+vOfV6tGI7jugLMv9lV8xHfG+9UapdGWEbQx4DYbJEwmjpY4uKnI3UPkbG7PvOkoU12Dc8JQ7ELbl9t1Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Pd8igZkI; arc=none smtp.client-ip=209.85.221.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Pd8igZkI" Received: by mail-wr1-f48.google.com with SMTP id ffacd0b85a97d-452aacde862so298603f8f.0 for ; Tue, 19 May 2026 13:48:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779223700; x=1779828500; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+dQdC9oLqGqR6Yemw3ngZxXH5nQjTXJGwmXiYcKTYls=; b=Pd8igZkIw9G8LfKTgHoNZlhYGcxeqABunGWVVA3e9CvynGho4AFCPd1Yxv9zm5Ix3V o8Al9G/QLCWWm6/SM0ffhJonYMoeiwEzHlPnFx/c/AgYlN4soKTd1Pm8btr7dRdH7rcK izsGdwxy+59l7mEsutOFBTLpSstnLFOx6vqjBD+39V+7TGcoSKotrwLcD4U+VIhlV4RM vgjCkjpwgTtyBDosOYXMfU/iSfA82+DNDtX8kILOgJb78xZzKIFajCVAMfwbrZtgI7X/ Alp3aC9RRX8pvXta6XGnGg6bRLzkEFB/5PE9/WSP0P9E5j7gmyIdT4bY6YT8A0gKjsh2 UdEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779223700; x=1779828500; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=+dQdC9oLqGqR6Yemw3ngZxXH5nQjTXJGwmXiYcKTYls=; b=ZyvKNSoadrEFpKXKRzzWDudnK/XRpe5PlK2fqnWxPzhICwNigDEre6JQFRlbnH/tqC XuUHvJ3uVR0tOTWRdSYyp4DOi7v8KfFbf0DgGZcDCwCLz/RHlc08QdHuLma23bzQDw+a 3I2CRDQi20l+ZRCssYWJ+pDRuiuHTMYPmFTr5YKFS+f7o/MtXUN3lUWW8+kNRQvmrcPt iBRPB7MbnjK44RX7Ldte2Ibi++nBVsf26E0yCcnkVc0k/HFbVEKqmjdr9xyffD0hUJD0 3sZWIdbjwe2FLgu54RC5iBScvgFgEOnIYO773ZRvTxv1+WIa42sklbsDmIqaynj1fNvy oojw== X-Forwarded-Encrypted: i=1; AFNElJ8fPsqWv+3cgVBtvxcEsCIfPuRZ+3YoNOTYvU2BSp72rDQe9sWtJL8h8NbMbBeKgupfKNaObAF2jvg8Yks=@vger.kernel.org X-Gm-Message-State: AOJu0YxsdCviR+y7Wul8cUHR3o/gFYVIGoxYjfmidNDIHTjfLRHPudLP 7U3XFoSwe+INfW5iH4mxYq4cq9UQvveGNFybbRlHOafXD2ClkbqdgxED X-Gm-Gg: Acq92OEo2Qgdz+1EFfk+WEsf/NlVAWqdgdCkd9l91lw5S7Xyl+sa9b04HsuQd20ppil G4Ouz4m3zQ1D9I6vVGmRpeK4etGRz2Hu60fNeOfmdHsrD8pbPH7jTZRxkEoYDEJ0OMIxgrdQOo6 AaVYZQYK+MKQiYE6iim2c6OXoMlL2s+dfFEsAGbiaRNE+ZehkowzYrPybJxjBWVQo8ZdPv66yPn IwiLiSrmjHsVGtWnp5DJgwEP0fwmV/yBYNkSUw0Mnz7n+Fni3HAn4T8WqU+4XgHuOr+8Yw8IIlR z3yL2J0uj31r8Ax7MyWUY5m+UQi7QBsPiI6Kr9zVBMLHyfJ1Clj0KBFEHSScgxuzYzHk2kYLqzp d5PT0RuupuiEir5BTQxMkiUFMFquQTVICsU+EHmMwvLcsdDWZVYwjisEs73qRHyDx69TTZxv07K T7ok7WSqHgTpxLGnPyg3nwmU1SYeDfxLaw+L1Pk6z/xgn7l4WvV/FEZuV/BZUODV4EWv5SLLEr0 A== X-Received: by 2002:a05:600c:198d:b0:487:1826:e138 with SMTP id 5b1f17b1804b1-48fe6309a99mr184655105e9.1.1779223700120; Tue, 19 May 2026 13:48:20 -0700 (PDT) Received: from menon.v.cablecom.net (84-74-0-139.dclient.hispeed.ch. [84.74.0.139]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48fe4dac000sm356457755e9.0.2026.05.19.13.48.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 May 2026 13:48:19 -0700 (PDT) From: Lothar Rubusch To: thorsten.blum@linux.dev, herbert@gondor.apana.org.au, davem@davemloft.net, nicolas.ferre@microchip.com, alexandre.belloni@bootlin.com, claudiu.beznea@tuxon.dev Cc: linux-crypto@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, l.rubusch@gmail.com Subject: [PATCH v2 11/12] crypto: atmel-sha204a - fix heap info leak on I2C transfer failure Date: Tue, 19 May 2026 20:48:02 +0000 Message-Id: <20260519204803.17034-12-l.rubusch@gmail.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260519204803.17034-1-l.rubusch@gmail.com> References: <20260519204803.17034-1-l.rubusch@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When a non-blocking read operation is requested, the driver dynamically allocates memory to track asynchronous transfer status. If the underlying I2C transmission fails, atmel_sha204a_rng_done() logs a rate-limited warning but incorrectly proceeds to cache the pointer to this uninitialized buffer inside the rng->priv data field anyway. On subsequent execution passes, atmel_sha204a_rng_read_nonblocking() detects the stale rng->priv value, skips executing a hardware data read, and copies up to 32 bytes of uninitialized kernel heap data from this garbage memory pool straight back into the system's hwrng data stream. Fix this information disclosure vector by immediately releasing the allocated asynchronous work data buffer and explicitly clearing the tracking pointer context whenever an I2C transaction returns a non-zero error status. Additionally, ensure that tfm counter is decremented within the error path to prevent reference counter stagnation, which would otherwise leave the driver in a permanently busy state. Finding by a sashiko side-review. Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator") Signed-off-by: Lothar Rubusch --- drivers/crypto/atmel-sha204a.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/atmel-sha204a.c b/drivers/crypto/atmel-sha204a.c index 38a269186e2a..3d29543032cc 100644 --- a/drivers/crypto/atmel-sha204a.c +++ b/drivers/crypto/atmel-sha204a.c @@ -31,10 +31,15 @@ static void atmel_sha204a_rng_done(struct atmel_i2c_work_data *work_data, struct atmel_i2c_client_priv *i2c_priv = work_data->ctx; struct hwrng *rng = areq; - if (status) + if (status) { dev_warn_ratelimited(&i2c_priv->client->dev, "i2c transaction failed (%d)\n", status); + kfree(work_data); + rng->priv = 0; + atomic_dec(&i2c_priv->tfm_count); + return; + } rng->priv = (unsigned long)work_data; atomic_dec(&i2c_priv->tfm_count); -- 2.39.5