• Greg Kurz's avatar
    hwrng: pseries - port to new read API and fix stack corruption · 24c65bc7
    Greg Kurz authored
    The add_early_randomness() function in drivers/char/hw_random/core.c passes
    a 16-byte buffer to pseries_rng_data_read(). Unfortunately, plpar_hcall()
    returns four 64-bit values and trashes 16 bytes on the stack.
    
    This bug has been lying around for a long time. It got unveiled by:
    
    commit d3cc7996
    Author: Amit Shah <amit.shah@redhat.com>
    Date:   Thu Jul 10 15:42:34 2014 +0530
    
        hwrng: fetch randomness only after device init
    
    It may trig a oops while loading or unloading the pseries-rng module for both
    PowerVM and PowerKVM guests.
    
    This patch does two things:
    - pass an intermediate well sized buffer to plpar_hcall(). This is acceptalbe
      since we're not on a hot path.
    - move to the new read API so that we know the return buffer size for sure.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarGreg Kurz <gkurz@linux.vnet.ibm.com>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    24c65bc7
pseries-rng.c 2.81 KB