Herbert Xu 5030d4c798 hwrng: core - Fix page fault dead lock on mmap-ed hwrng ...

commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream.

There is a dead-lock in the hwrng device read path.  This triggers
when the user reads from /dev/hwrng into memory also mmap-ed from
/dev/hwrng.  The resulting page fault triggers a recursive read
which then dead-locks.

Fix this by using a stack buffer when calling copy_to_user.

Reported-by: Edward Adam Davis <eadavis@qq.com>
Reported-by: syzbot+c52ab18308964d248092@syzkaller.appspotmail.com
Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-02-23 08:24:48 +01:00

..

agp

parisc: sba: Fix compile warning wrt list of SBA devices

2023-10-10 21:46:39 +02:00

hw_random

hwrng: core - Fix page fault dead lock on mmap-ed hwrng

2024-02-23 08:24:48 +01:00

ipmi

ipmi_si: fix a memleak in try_smi_init()

2023-09-23 10:59:54 +02:00

mwave

char/mwave: Adjust io port register size

2022-01-27 09:19:38 +01:00

pcmcia

char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol()

2021-07-14 16:53:40 +02:00

tpm

tpm_tis: Resend command to recover from data transfer errors

2023-09-23 11:00:03 +02:00

xilinx_hwicap

…

xillybus

…

adi.c

…

apm-emulation.c

…

applicom.c

…

applicom.h

…

bsr.c

…

ds1620.c

…

dsp56k.c

…

dtlk.c

…

efirtc.c

…

hangcheck-timer.c

…

hpet.c

char: hpet: add checks after calling ioremap

2021-06-03 08:59:09 +02:00

Kconfig

random: credit cpu and bootloader seeds by default

2022-06-22 14:11:21 +02:00

lp.c

…

Makefile

…

mem.c

random: restore O_NONBLOCK support

2022-10-15 07:54:40 +02:00

misc.c

…

mspec.c

…

nsc_gpio.c

…

nvram.c

…

nwbutton.c

…

nwbutton.h

…

nwflash.c

…

pc8736x_gpio.c

…

powernv-op-panel.c

…

ppdev.c

…

ps3flash.c

…

random.c

random: use expired timer rather than wq for mixing fast pool

2022-10-15 07:54:40 +02:00

raw.c

…

rtc.c

…

scx200_gpio.c

…

sonypi.c

…

tb0219.c

…

tlclk.c

drivers: char: tlclk.c: Avoid data race between init and interrupt handler

2020-10-01 13:17:56 +02:00

toshiba.c

…

ttyprintk.c

ttyprintk: Add TTY hangup callback.

2021-05-14 09:44:23 +02:00

uv_mmtimer.c

…

virtio_console.c

virtio_console: eliminate anonymous module_init & module_exit

2022-04-15 14:18:36 +02:00