Commit f9c6d498 authored May 16, 2014 by Theodore Ts'o

random: fix BUG_ON caused by accounting simplification



Commit ee1de406 ("random: simplify accounting logic") simplified
things too much, in that it allows the following to trigger an
overflow that results in a BUG_ON crash:

dd if=/dev/urandom of=/dev/zero bs=67108707 count=1

Thanks to Peter Zihlstra for discovering the crash, and Hannes
Frederic for analyizing the root cause.

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reported-by: Peter Zijlstra <peterz@infradead.org>
Reported-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Greg Price <price@mit.edu>

parent d6d211db

drivers/char/random.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -995,8 +995,11 @@ retry:
		ibytes = min_t(size_t, ibytes, have_bytes - reserved);
		if (ibytes < min)
		ibytes = 0;
		entropy_count = max_t(int, 0,
		entropy_count - (ibytes << (ENTROPY_SHIFT + 3)));
		if (have_bytes >= ibytes + reserved)
		entropy_count -= ibytes << (ENTROPY_SHIFT + 3);
		else
		entropy_count = reserved << (ENTROPY_SHIFT + 3);

		if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
		goto retry;

Admin message