The RNG seed boot record is memzeroed after processing, in order to
preserve forward secrecy. By saving the bootinfo for procfs prior to
that, forward secrecy is violated, since it becomes possible to recover
past states. So, save the bootinfo block only after first processing
them.
Fixes: a1ee38ab1a75 ("m68k: virt: Use RNG seed from bootinfo block")
Signed-off-by: Jason A. Donenfeld <[email protected]>
---
arch/m68k/kernel/setup_mm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/m68k/kernel/setup_mm.c b/arch/m68k/kernel/setup_mm.c
index e62fa8f2149b..7e7ef67cff8b 100644
--- a/arch/m68k/kernel/setup_mm.c
+++ b/arch/m68k/kernel/setup_mm.c
@@ -109,10 +109,9 @@ extern void paging_init(void);
static void __init m68k_parse_bootinfo(const struct bi_record *record)
{
+ const struct bi_record *first_record = record;
uint16_t tag;
- save_bootinfo(record);
-
while ((tag = be16_to_cpu(record->tag)) != BI_LAST) {
int unknown = 0;
const void *data = record->data;
@@ -182,6 +181,8 @@ static void __init m68k_parse_bootinfo(const struct bi_record *record)
record = (struct bi_record *)((unsigned long)record + size);
}
+ save_bootinfo(first_record);
+
m68k_realnum_memory = m68k_num_memory;
#ifdef CONFIG_SINGLE_MEMORY_CHUNK
if (m68k_num_memory > 1) {
--
2.37.3
On Fri, Sep 23, 2022 at 7:03 PM Jason A. Donenfeld <[email protected]> wrote:
> The RNG seed boot record is memzeroed after processing, in order to
> preserve forward secrecy. By saving the bootinfo for procfs prior to
> that, forward secrecy is violated, since it becomes possible to recover
> past states. So, save the bootinfo block only after first processing
> them.
>
> Fixes: a1ee38ab1a75 ("m68k: virt: Use RNG seed from bootinfo block")
> Signed-off-by: Jason A. Donenfeld <[email protected]>
Reviewed-by: Geert Uytterhoeven <[email protected]>
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
Hi Geert,
On 9/26/22, Geert Uytterhoeven <[email protected]> wrote:
> On Fri, Sep 23, 2022 at 7:03 PM Jason A. Donenfeld <[email protected]> wrote:
>> The RNG seed boot record is memzeroed after processing, in order to
>> preserve forward secrecy. By saving the bootinfo for procfs prior to
>> that, forward secrecy is violated, since it becomes possible to recover
>> past states. So, save the bootinfo block only after first processing
>> them.
>>
>> Fixes: a1ee38ab1a75 ("m68k: virt: Use RNG seed from bootinfo block")
>> Signed-off-by: Jason A. Donenfeld <[email protected]>
>
> Reviewed-by: Geert Uytterhoeven <[email protected]>
Thanks for the review.
Did you intend to take these 3 patches through your m68k tree, or did
you want me to take them for some reason instead?
Jason
Hi Jason,
On Mon, Sep 26, 2022 at 12:06 PM Jason A. Donenfeld <[email protected]> wrote:
> On 9/26/22, Geert Uytterhoeven <[email protected]> wrote:
> > On Fri, Sep 23, 2022 at 7:03 PM Jason A. Donenfeld <[email protected]> wrote:
> >> The RNG seed boot record is memzeroed after processing, in order to
> >> preserve forward secrecy. By saving the bootinfo for procfs prior to
> >> that, forward secrecy is violated, since it becomes possible to recover
> >> past states. So, save the bootinfo block only after first processing
> >> them.
> >>
> >> Fixes: a1ee38ab1a75 ("m68k: virt: Use RNG seed from bootinfo block")
> >> Signed-off-by: Jason A. Donenfeld <[email protected]>
> >
> > Reviewed-by: Geert Uytterhoeven <[email protected]>
>
> Thanks for the review.
>
> Did you intend to take these 3 patches through your m68k tree, or did
> you want me to take them for some reason instead?
This is all TBD, see the comments I'm writing on the other patches ;-)
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds