Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
hwrng: core - Add WARN_ON for buggy read return values
If a buggy driver returns a length that is longer than the size
of the buffer provided to it, then this may lead to a buffer overread
in the caller.
Stop this by adding a check for it in the hwrng core.
Reported-by: Guangwu Zhang <guazhang@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+9
-2
+9
-2
drivers/char/hw_random/core.c
+9
-2
drivers/char/hw_random/core.c
···
181
181
int present;
182
182
183
183
BUG_ON(!mutex_is_locked(&reading_mutex));
184
-
if (rng->read)
185
-
return rng->read(rng, (void *)buffer, size, wait);
184
+
if (rng->read) {
185
+
int err;
186
+
187
+
err = rng->read(rng, buffer, size, wait);
188
+
if (WARN_ON_ONCE(err > 0 && err > size))
189
+
err = size;
190
+
191
+
return err;
192
+
}
186
193
187
194
if (rng->data_present)
188
195
present = rng->data_present(rng, wait);