random: avoid initializing twice in credit race
authorJason A. Donenfeld <Jason@zx2c4.com>
Mon, 9 May 2022 11:40:55 +0000 (13:40 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 30 May 2022 07:29:16 +0000 (09:29 +0200)
commitc4e600154ac07d7b65c73611b4e408bb449f1b44
tree47c3bc3db3b00e9b758edcd87342a6ff94f6d6d3
parent23a1b984f4b878faa1be22f5fcbb974f3ddd4018
random: avoid initializing twice in credit race

commit fed7ef061686cc813b1f3d8d0edc6c35b4d3537b upstream.

Since all changes of crng_init now go through credit_init_bits(), we can
fix a long standing race in which two concurrent callers of
credit_init_bits() have the new bit count >= some threshold, but are
doing so with crng_init as a lower threshold, checked outside of a lock,
resulting in crng_reseed() or similar being called twice.

In order to fix this, we can use the original cmpxchg value of the bit
count, and only change crng_init when the bit count transitions from
below a threshold to meeting the threshold.

Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/char/random.c