hwrng: core - Add WARN_ON for buggy read return values

If a buggy driver returns a length that is longer than the size
of the buffer provided to it, then this may lead to a buffer overread
in the caller.

Stop this by adding a check for it in the hwrng core.

Reported-by: Guangwu Zhang <guazhang@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 57c51efa56131e6cee102963aaa11fcd6aee06a1..018316f546215abd4e179764487fb58d1c822d5f 100644 (file)
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -181,8 +181,15 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
        int present;
 
        BUG_ON(!mutex_is_locked(&reading_mutex));
-       if (rng->read)
-               return rng->read(rng, (void *)buffer, size, wait);
+       if (rng->read) {
+               int err;
+
+               err = rng->read(rng, buffer, size, wait);
+               if (WARN_ON_ONCE(err > 0 && err > size))
+                       err = size;
+
+               return err;
+       }
 
        if (rng->data_present)
                present = rng->data_present(rng, wait);