Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1462392

[PATCH 4.4 21/49] random: strengthen input validation for RNDADDTOENTCNT

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.4 21/49] random: strengthen input validation for RNDADDTOENTCNT
Date 2016-08-14 22:40 +0200
Message-ID <s6amm-4wI-33@gated-at.bofh.it> (permalink)
References <s6acF-4ts-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit 86a574de4590ffe6fd3f3ca34cdcf655a78e36ec upstream.

Don't allow RNDADDTOENTCNT or RNDADDENTROPY to accept a negative
entropy value.  It doesn't make any sense to subtract from the entropy
counter, and it can trigger a warning:

random: negative entropy/overflow: pool input count -40000
------------[ cut here ]------------
WARNING: CPU: 3 PID: 6828 at drivers/char/random.c:670[<      none
 >] credit_entropy_bits+0x21e/0xad0 drivers/char/random.c:670
Modules linked in:
CPU: 3 PID: 6828 Comm: a.out Not tainted 4.7.0-rc4+ #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffffffff880b58e0 ffff88005dd9fcb0 ffffffff82cc838f ffffffff87158b40
 fffffbfff1016b1c 0000000000000000 0000000000000000 ffffffff87158b40
 ffffffff83283dae 0000000000000009 ffff88005dd9fcf8 ffffffff8136d27f
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82cc838f>] dump_stack+0x12e/0x18f lib/dump_stack.c:51
 [<ffffffff8136d27f>] __warn+0x19f/0x1e0 kernel/panic.c:516
 [<ffffffff8136d48c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:551
 [<ffffffff83283dae>] credit_entropy_bits+0x21e/0xad0 drivers/char/random.c:670
 [<     inline     >] credit_entropy_bits_safe drivers/char/random.c:734
 [<ffffffff8328785d>] random_ioctl+0x21d/0x250 drivers/char/random.c:1546
 [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [<ffffffff8185316c>] do_vfs_ioctl+0x18c/0xff0 fs/ioctl.c:674
 [<     inline     >] SYSC_ioctl fs/ioctl.c:689
 [<ffffffff8185405f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
 [<ffffffff86a995c0>] entry_SYSCALL_64_fastpath+0x23/0xc1
arch/x86/entry/entry_64.S:207
---[ end trace 5d4902b2ba842f1f ]---

This was triggered using the test program:

// autogenerated by syzkaller (http://github.com/google/syzkaller)

int main() {
        int fd = open("/dev/random", O_RDWR);
        int val = -5000;
        ioctl(fd, RNDADDTOENTCNT, &val);
        return 0;
}

It's harmless in that (a) only root can trigger it, and (b) after
complaining the code never does let the entropy count go negative, but
it's better to simply not allow this userspace from passing in a
negative entropy value altogether.

Google-Bug-Id: #29575089
Reported-By: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/random.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -722,15 +722,18 @@ retry:
 	}
 }
 
-static void credit_entropy_bits_safe(struct entropy_store *r, int nbits)
+static int credit_entropy_bits_safe(struct entropy_store *r, int nbits)
 {
 	const int nbits_max = (int)(~0U >> (ENTROPY_SHIFT + 1));
 
+	if (nbits < 0)
+		return -EINVAL;
+
 	/* Cap the value to avoid overflows */
 	nbits = min(nbits,  nbits_max);
-	nbits = max(nbits, -nbits_max);
 
 	credit_entropy_bits(r, nbits);
+	return 0;
 }
 
 /*********************************************************************
@@ -1542,8 +1545,7 @@ static long random_ioctl(struct file *f,
 			return -EPERM;
 		if (get_user(ent_count, p))
 			return -EFAULT;
-		credit_entropy_bits_safe(&input_pool, ent_count);
-		return 0;
+		return credit_entropy_bits_safe(&input_pool, ent_count);
 	case RNDADDENTROPY:
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
@@ -1557,8 +1559,7 @@ static long random_ioctl(struct file *f,
 				    size);
 		if (retval < 0)
 			return retval;
-		credit_entropy_bits_safe(&input_pool, ent_count);
-		return 0;
+		return credit_entropy_bits_safe(&input_pool, ent_count);
 	case RNDZAPENTCNT:
 	case RNDCLEARPOOL:
 		/*

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/49] 4.4.18-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 33/49] mm: memcontrol: fix swap counter leak on swapout from offline cgroup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 05/49] net: bgmac: Fix infinite loop in bgmac_dma_tx_add() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 26/49] x86/mtrr: Fix Xorg crashes in Qemu sessions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 28/49] x86/xen, pat: Remove PAT table init code from Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 01/49] tcp: make challenge acks less predictable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 03/49] ipv4: reject RTNH_F_DEAD and RTNH_F_LINKDOWN from user space Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 12/49] PNP: Add Broadwell to Intel MCH size workaround Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 23/49] x86/mm/pat: Add support of non-default PAT MSR setting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 24/49] x86/mm/pat: Add pat_disable() interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 10/49] scsi: ignore errors from scsi_dh_add_device() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 20/49] apparmor: fix ref count leak when profile sha1 hash is read Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 41/49] fs/dcache.c: avoid soft-lockup in dput() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 49/49] ext4: fix reference counting bug on block allocation error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 07/49] qed: Fix setting/clearing bit in completion bitmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 38/49] fuse: fsync() did not return IO errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 46/49] ext4: dont call ext4_should_journal_data() on the journal inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 43/49] crypto: scatterwalk - Fix test in scatterwalk_done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 19/49] Revert "s390/kdump: Clear subchannel ID to signal non-CCW/SCSI IPL" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 45/49] ext4: fix deadlock during page writeback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 22/49] devpts: clean up interface to pty drivers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 48/49] ext4: short-cut orphan cleanup on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 32/49] mm: memcontrol: fix cgroup creation failure after many small jobs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 06/49] net/irda: fix NULL pointer dereference on memory allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 27/49] x86/mtrr: Fix PAT init handling when MTRR is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 44/49] ext4: check for extents that wrap around Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 29/49] x86/pat: Document the PAT initialization sequence Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 36/49] block: fix use-after-free in seq file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:30 +0200
  [PATCH 4.4 37/49] sysv, ipc: fix security-layer leaking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  [PATCH 4.4 09/49] ipath: Restrict use of the write() interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  [PATCH 4.4 35/49] x86/syscalls/64: Add compat_sys_keyctl for 32-bit userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  [PATCH 4.4 21/49] random: strengthen input validation for RNDADDTOENTCNT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  [PATCH 4.4 04/49] bonding: set carrier off for devices created through netlink Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  [PATCH 4.4 11/49] PNP: Add Haswell-ULT to Intel MCH size workaround Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200
  Re: [PATCH 4.4 00/49] 4.4.18-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-15 10:00 +0200
  Re: [PATCH 4.4 00/49] 4.4.18-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-15 15:10 +0200
  Re: [PATCH 4.4 00/49] 4.4.18-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-08-16 06:10 +0200

csiph-web