Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Luca Dariz <luca.dariz@hitachi-powergrids.com>
To:     linux-crypto@vger.kernel.org
Cc:     Luca Dariz <luca.dariz@hitachi-powergrids.com>,
        Matt Mackall <mpm@selenic.com>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        Colin Ian King <colin.king@canonical.com>,
        Holger Brunck <holger.brunck@hitachi-powergrids.com>,
        Valentin Longchamp <valentin.longchamp@hitachi-powergrids.com>
Subject: [PATCH] hwrng: fix khwrng lifecycle
Date:   Mon, 14 Dec 2020 18:29:33 +0100
Message-Id: <20201214172933.25580-1-luca.dariz@hitachi-powergrids.com>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

There are two issues with the management of the kernel thread to gather
entropy:
* it can terminate also if the rng is removed, and in this case it doesn'=
t
  synchronize with kthread_should_stop(), but it directly sets hwrng_fill
  to NULL. If this happens after the NULL check but before kthread_stop()
  is called, we'll have a NULL pointer dereference.
* if we have a register/unregister too fast, it can happen that the kthre=
ad
  is not yet started when kthread_stop is called, and this seems to leave=
 a
  corrupted or uninitialized kthread struct. This is detected by the
  WARN_ON at kernel/kthread.c:75 and later causes a page domain fault.

CC: Matt Mackall <mpm@selenic.com>
CC: Herbert Xu <herbert@gondor.apana.org.au>
CC: Colin Ian King <colin.king@canonical.com>
CC: Holger Brunck <holger.brunck@hitachi-powergrids.com>
CC: Valentin Longchamp <valentin.longchamp@hitachi-powergrids.com>
Signed-off-by: Luca Dariz <luca.dariz@hitachi-powergrids.com>
---
 drivers/char/hw_random/core.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.=
c
index 8c1c47dd9f46..5845da93c7f4 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -31,6 +31,7 @@ static struct hwrng *current_rng;
 /* the current rng has been explicitly chosen by user via sysfs */
 static int cur_rng_set_by_user;
 static struct task_struct *hwrng_fill;
+static struct completion hwrng_started =3D COMPLETION_INITIALIZER(hwrng_=
started);
 /* list of registered rngs, sorted decending by quality */
 static LIST_HEAD(rng_list);
 /* Protects rng_list and current_rng */
@@ -432,12 +433,15 @@ static int hwrng_fillfn(void *unused)
 {
 	long rc;
=20
+	complete(&hwrng_started);
 	while (!kthread_should_stop()) {
 		struct hwrng *rng;
=20
 		rng =3D get_current_rng();
-		if (IS_ERR(rng) || !rng)
-			break;
+		if (IS_ERR(rng) || !rng) {
+			msleep_interruptible(10000);
+			continue;
+		}
 		mutex_lock(&reading_mutex);
 		rc =3D rng_get_data(rng, rng_fillbuf,
 				  rng_buffer_size(), 1);
@@ -462,6 +466,8 @@ static void start_khwrngd(void)
 	if (IS_ERR(hwrng_fill)) {
 		pr_err("hwrng_fill thread creation failed\n");
 		hwrng_fill =3D NULL;
+	} else {
+		wait_for_completion(&hwrng_started);
 	}
 }
=20
--=20
2.24.3