Herbert Xu c6a8111aac hwrng: core - Fix page fault dead lock on mmap-ed hwrng ...

commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream.

There is a dead-lock in the hwrng device read path.  This triggers
when the user reads from /dev/hwrng into memory also mmap-ed from
/dev/hwrng.  The resulting page fault triggers a recursive read
which then dead-locks.

Fix this by using a stack buffer when calling copy_to_user.

Reported-by: Edward Adam Davis <eadavis@qq.com>
Reported-by: syzbot+c52ab18308964d248092@syzkaller.appspotmail.com
Fixes: 9996508b33 ("hwrng: core - Replace u32 in driver API with byte array")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-02-23 08:41:52 +01:00

..

amd-rng.c

hwrng: amd - Fix PCI device refcount leak

2023-01-14 10:15:54 +01:00

atmel-rng.c

hwrng: atmel - disable trng on failure path

2022-04-08 14:40:01 +02:00

ba431-rng.c

hwrng: ba431 - Include kernel.h

2020-07-16 21:49:01 +10:00

bcm2835-rng.c

hwrng: bcm2835 - Constify bcm2835_rng_devtype[]

2020-07-09 18:25:21 +10:00

cavium-rng-vf.c

hwrng: cavium - Check health status while reading random data

2022-04-08 14:39:59 +02:00

cavium-rng.c

hwrng: cavium - Check health status while reading random data

2022-04-08 14:39:59 +02:00

cctrng.c

hwrng: cctrn - Simplify with dev_err_probe()

2020-09-04 17:57:15 +10:00

cctrng.h

hwrng: cctrng - introduce Arm CryptoCell driver

2020-04-16 16:49:20 +10:00

core.c

hwrng: core - Fix page fault dead lock on mmap-ed hwrng

2024-02-23 08:41:52 +01:00

exynos-trng.c

hwrng: exynos - Fix runtime PM imbalance on error

2021-07-14 16:55:50 +02:00

geode-rng.c

hwrng: geode - fix accessing registers

2023-11-20 11:06:50 +01:00

hisi-rng.c

hwrng: hisi - Fix W=1 unused variable warning

2020-07-09 18:25:12 +10:00

hisi-trng-v2.c

hwrng: hisi - add HiSilicon TRNG driver support

2019-11-08 23:15:51 +08:00

imx-rngc.c

hwrng: imx-rngc - fix the timeout for init and self check

2023-07-27 08:44:27 +02:00

ingenic-rng.c

crypto: ingenic - Drop kfree for memory allocated with devm_kzalloc

2020-08-21 14:43:51 +10:00

ingenic-trng.c

hwrng: ingenic - Fix a resource leak in an error handling path

2021-03-04 11:37:37 +01:00

intel-rng.c

hwrng: intel - cleanup initialization

2020-08-21 14:47:49 +10:00

iproc-rng200.c

hwrng: iproc-rng200 - Implement suspend and resume calls

2023-09-19 12:20:09 +02:00

ixp4xx-rng.c

…

Kconfig

hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER

2022-04-08 14:39:59 +02:00

ks-sa-rng.c

hwrng: ks-sa - Replace HTTP links with HTTPS ones

2020-07-16 21:49:06 +10:00

Makefile

hwrng: ingenic - Add hardware TRNG for Ingenic X1830

2020-09-25 17:46:41 +10:00

meson-rng.c

hwrng: meson - use devm_platform_ioremap_resource() to simplify code

2019-10-26 02:09:55 +11:00

mtk-rng.c

hwrng: mtk - Force runtime pm ops for sleep ops

2021-11-18 14:04:06 +01:00

mxc-rnga.c

hwrng: mxc-rnga - use semicolons rather than commas to separate statements

2020-10-02 18:02:15 +10:00

n2-asm.S

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

n2-drv.c

hwrng: n2-drv - fix typo

2019-08-08 12:07:49 +10:00

n2rng.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nomadik-rng.c

hwrng: nomadik - keep clock enabled while hwrng is registered

2023-09-19 12:20:08 +02:00

npcm-rng.c

hwrng: npcm - modify readl to readb

2020-10-02 18:02:13 +10:00

octeon-rng.c

hwrng: octeon - Fix sparse warnings

2020-07-09 18:25:14 +10:00

omap3-rom-rng.c

hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume()

2022-06-09 10:21:17 +02:00

omap-rng.c

hwrng: omap - Fix W=1 unused variable warning

2020-07-09 18:25:11 +10:00

optee-rng.c

hwrng: optee - fix wait use case

2020-08-21 14:45:28 +10:00

pasemi-rng.c

hwrng: pasemi - use devm_platform_ioremap_resource() to simplify code

2019-10-26 02:09:56 +11:00

pic32-rng.c

hwrng: pic32 - Fix W=1 unused variable warning

2020-07-09 18:25:13 +10:00

powernv-rng.c

hwrng: drivers - Use device-managed registration API

2019-08-02 14:44:33 +10:00

pseries-rng.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 333

2019-06-05 17:37:06 +02:00

s390-trng.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 376

2019-06-05 17:37:10 +02:00

st-rng.c

hwrng: st - keep clock enabled while hwrng is registered

2023-07-27 08:44:01 +02:00

stm32-rng.c

hwrng: stm32 - use semicolons rather than commas to separate statements

2020-10-02 18:02:14 +10:00

timeriomem-rng.c

hwrng: timeriomem - Fix cooldown period calculation

2021-03-04 11:37:49 +01:00

tx4939-rng.c

hwrng: tx4939 - use devm_platform_ioremap_resource() to simplify code

2019-10-26 02:09:57 +11:00

via-rng.c

hwrng: via_rng: Convert to new X86 CPU match macros

2020-03-24 21:36:26 +01:00

virtio-rng.c

hwrng: virtio - Fix race on data_avail and actual data

2023-07-27 08:43:59 +02:00

xgene-rng.c

hwrng: xgene - Delete an error message in xgene_rng_probe()

2020-04-16 16:49:22 +10:00

xiphera-trng.c

hwrng: xiphera-trng: add support for XIP8001B hwrng

2020-09-11 14:39:17 +10:00