From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE8943F39F3 for ; Wed, 20 May 2026 15:57:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779292654; cv=none; b=MB7yNveMWwnYbvTljjRpkckYorMyPJ6Gg5TvweMLyhh0+vEbsvZ/afYNO6FKBJaLB2SmCSw+BWHpzp5ae45NNXy0FV5j7g7Gislv2XptJSfdlIC6Z7INcO2Qqq1ZM3Qg+5xR6GizR3jHnPi5Q5os4IVif76DzeCLScUqM8egWOg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779292654; c=relaxed/simple; bh=GcT4179KEn1MmyXneciyyOy4CZWvu0iEu43IoD6Z7v4=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=g0vW78EEERHcX55E6PdMmF6Kt+9jtzYAVnmVe3P3wmDKibbamQ0G/zYqHWgtZTFG1O03bZn6WgRFQJ/WngSxfYPDkmmLz7Sbv73udSqn/lJOTy3WFbmXrnC2+R1NAOg3Yb7znzbT6+Ssd6hvSbYaq0I2dyEpr1fEvWV7bz9neCc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bfg9BhpI; arc=none smtp.client-ip=209.85.128.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bfg9BhpI" Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-48e69e60063so4651525e9.1 for ; Wed, 20 May 2026 08:57:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779292647; x=1779897447; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=d00Co/CPYFX5ZE7rQHh1/lw+DiNtp4wsDbvq3jgMwnU=; b=bfg9BhpIEV1O5nTTBchU0I53Qigv+0GXX6B5Yed1BlNU5/Be+eqMGfybxxToMyTjbt Ssu+Xdw6u73WjHV64KQ7TWJ6X6fiIjiYyAReshHyd3DOCmQfTySi2sylL9bG1wa2gzOO RzVl+v5WhvsZQFugAIGOV/dJtsMTEvVOYtPkYVMB/6st1eIQKFxwr7zDkpIrb0lM0Hbl fa/vNFt6H9tOhDiZ5YLHiw0QRP3TS01ADhtt3E4pqRwrFTHUWc7jQweV3jm6el1FzjrV zzkdaCgQvC9uJCyJzrulxLbG3+A5OX2+ZhalZss7Mf1uAToxrZ6/cnxYACUfPM9DIbrn VV4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779292647; x=1779897447; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=d00Co/CPYFX5ZE7rQHh1/lw+DiNtp4wsDbvq3jgMwnU=; b=k2x8sIjQSlrkhjvNBEXk707ARvP6PDUxdr+dWE5HqT63OqtLaGJGa1xzi0qaHtjvQj nSgLoqFxpc/fooGfSsb3CVkgKIozcGPTQ0tKNRGuIfYAKa+17J54ryGQDqQoOkM5agrm jRn0FFHBHYmCaB5MzxgVbm2aVkb1TDEH6yskDJG5C89z67Y/xAp99fPHVKHMs8NTz217 vDFltp3bomwmuQQdSYNYZZSqcIy2gVUrz69Q02cPhFlSqw0VRr5DVBeprhde1r4pviIh 6i5zFosycQUJJvQT3BoDD6E5trOHJoUeFotxAKIVGjmQbCR+bHndgvuXjLk3Xzpcc8L3 HQ1A== X-Forwarded-Encrypted: i=1; AFNElJ/7WqsOJDmt4whmuKXIp7yOsDn3HB4q0OUDq/OudIjDcYCbXX9SvfNKcdfabyDsIvLd5IPPKJbWDK7Ww8k=@vger.kernel.org X-Gm-Message-State: AOJu0Yyqv7rpPFvOUSHuE319LhZAZzknQgPIfatIJn1ju4h8j8+lQlRC tgowQuTUsUN7pj4yPBbdKOoLTUQCzmPlTPK1Qj655QgcQK/4cw6/XXC1 X-Gm-Gg: Acq92OEa1FwcuC8Irb6dpFmwMwG1J5g/QlwiOdDK7g8+oQ8dOdi2c2EXGEV8dvx8s1M FoiMyKoM7UGkHOL5R2lw0OxuSrW3mLXeLHuuA+8n/4jSbKZpU4k1T+Utsfx/Dlos8KBV93b8Mfd ujFUgYPqHmyKhipv1RHDqrXTsKJEfGllGh6IWD2VwpYvRi20Fv1DkcjJSindbzttRrN5nkLbKeh RHoiF9Pmbu3skir3MhVDXVEBCyUjqqxnODUZonWUzdLvR74KzAzBcMykuBkk95uiBO5HH1ZPM/3 iWS23LROZBUe9wsJsX3BBnzVXvDzoCRYqlsYvacI+ZMAauvSo2zTtpmsKw0xAKREUtna7RIN/aU BGkmQheLjuvYYzV5OR2okSYQtxqBxbkStmRmhoNdFiXujOH2RWl+glqDghJ0XCfAqZZbhQfI7vi y6FtAv9uJlc0WJVfn+mV3UtB/pBpPhNqFU7dF15yN1sEYHtwm3WNp+r8QB+y2arZg= X-Received: by 2002:a05:600c:3594:b0:490:502:8422 with SMTP id 5b1f17b1804b1-4900d55ec74mr107484465e9.6.1779292646691; Wed, 20 May 2026 08:57:26 -0700 (PDT) Received: from menon.v.cablecom.net (84-74-0-139.dclient.hispeed.ch. [84.74.0.139]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48febe79ce3sm137216715e9.31.2026.05.20.08.57.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 May 2026 08:57:26 -0700 (PDT) From: Lothar Rubusch To: thorsten.blum@linux.dev, herbert@gondor.apana.org.au, davem@davemloft.net, nicolas.ferre@microchip.com, alexandre.belloni@bootlin.com, claudiu.beznea@tuxon.dev, tudor.ambarus@linaro.org, ardb@kernel.org, linusw@kernel.org Cc: linux-crypto@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, l.rubusch@gmail.com Subject: [PATCH v3 11/12] crypto: atmel-sha204a - fix heap info leak on I2C transfer failure Date: Wed, 20 May 2026 15:57:02 +0000 Message-Id: <20260520155703.23018-12-l.rubusch@gmail.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260520155703.23018-1-l.rubusch@gmail.com> References: <20260520155703.23018-1-l.rubusch@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When a non-blocking read operation is requested, the driver dynamically allocates memory to track asynchronous transfer status. If the underlying I2C transmission fails, atmel_sha204a_rng_done() logs a rate-limited warning but incorrectly proceeds to cache the pointer to this uninitialized buffer inside the rng->priv data field anyway. On subsequent execution passes, atmel_sha204a_rng_read_nonblocking() detects the stale rng->priv value, skips executing a hardware data read, and copies up to 32 bytes of uninitialized kernel heap data from this garbage memory pool straight back into the system's hwrng data stream. Fix this information disclosure vector by immediately releasing the allocated asynchronous work data buffer and explicitly clearing the tracking pointer context whenever an I2C transaction returns a non-zero error status. Additionally, duplicate the tfm counter decrement within the new error path to ensure the reference counter is properly released before executing the early return, maintaining the driver's availability for subsequent requests. Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator") Signed-off-by: Lothar Rubusch --- drivers/crypto/atmel-sha204a.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/atmel-sha204a.c b/drivers/crypto/atmel-sha204a.c index db61ac0177f6..b51031ced7d1 100644 --- a/drivers/crypto/atmel-sha204a.c +++ b/drivers/crypto/atmel-sha204a.c @@ -31,10 +31,15 @@ static void atmel_sha204a_rng_done(struct atmel_i2c_work_data *work_data, struct atmel_i2c_client_priv *i2c_priv = work_data->ctx; struct hwrng *rng = areq; - if (status) + if (status) { dev_warn_ratelimited(&i2c_priv->client->dev, "i2c transaction failed (%d)\n", status); + kfree(work_data); + rng->priv = 0; + atomic_dec(&i2c_priv->tfm_count); + return; + } rng->priv = (unsigned long)work_data; atomic_dec(&i2c_priv->tfm_count); -- 2.39.5