random: fix data race on crng init time
authorEric Biggers <ebiggers@google.com>
Mon, 20 Dec 2021 22:41:57 +0000 (16:41 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 16 Jan 2022 08:14:23 +0000 (09:14 +0100)
commit61cca7d191c7c143bc8f3e779859f8b3d5100c89
tree85364bb198918ae700ea50830e894b22a67844ff
parent3de9478230c3e3ae0ae599847ca2ac6b7781e780
random: fix data race on crng init time

commit 009ba8568be497c640cab7571f7bfd18345d7b24 upstream.

_extract_crng() does plain loads of crng->init_time and
crng_global_init_time, which causes undefined behavior if
crng_reseed() and RNDRESEEDCRNG modify these corrently.

Use READ_ONCE() and WRITE_ONCE() to make the behavior defined.

Don't fix the race on crng->init_time by protecting it with crng->lock,
since it's not a problem for duplicate reseedings to occur.  I.e., the
lockless access with READ_ONCE() is fine.

Fixes: d848e5f8e1eb ("random: add new ioctl RNDRESEEDCRNG")
Fixes: e192be9d9a30 ("random: replace non-blocking pool with a Chacha20-based CRNG")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/char/random.c