Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 7 Oct 2022 09:29:23 +0200
From:   Sebastian Andrzej Siewior <bigeasy@linutronix.de>
To:     Sultan Alsawaf <sultan@kerneltoast.com>
Cc:     "Jason A. Donenfeld" <Jason@zx2c4.com>,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        Dominik Brodowski <linux@dominikbrodowski.net>
Subject: Re: [PATCH 2/2] random: spread out jitter callback to different CPUs
Message-ID: <Yz/VU/FhdgspxFdh@linutronix.de>
References: <20220930231050.749824-1-Jason@zx2c4.com>
 <20220930231050.749824-2-Jason@zx2c4.com>
 <YzgGmh6EQtWzO4HV@zx2c4.com>
 <Yz2+UsgVGRSm+o7W@linutronix.de>
 <Yz3yQzaNUcdIuUMX@zx2c4.com>
 <Yz55w4gNtZn8JzmG@linutronix.de>
 <Yz7JXEaTFWa1VLKJ@zx2c4.com>
 <Yz7M5zJmzKSk/LYH@linutronix.de>
 <Yz8E0lSmsMMB6KeO@sultan-box.localdomain>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <Yz8E0lSmsMMB6KeO@sultan-box.localdomain>
Precedence: bulk

On 2022-10-06 09:39:46 [-0700], Sultan Alsawaf wrote:
> Hi Sebastian,
Hi Sultan,

> But since a timer is marked as not-pending prior to when it runs, add_timer_on()
> can't detect if the timer is actively running; the above BUG_ON() won't be
> tripped. So the UaF scenario I forsee is that doing this:
>     add_timer_on(timer, 0);
>     // timer is actively running on CPU0, timer is no longer pending
>     add_timer_on(timer, 1); // changes timer base, won't wait for timer to stop
>     del_timer_sync(timer); // only checks CPU1 timer base for the running timer

/me taking notes.

> Sultan

Sebastian