From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Mon, 23 Sep 2024 06:05:52 +0000 (+0800)
Subject: hwrng: core - Add WARN_ON for buggy read return values
X-Git-Tag: v6.13-rc1~196^2~81
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fb10c7a84661471cdcc8998d63703211b873c126;p=thirdparty%2Fkernel%2Flinux.git

hwrng: core - Add WARN_ON for buggy read return values

If a buggy driver returns a length that is longer than the size
of the buffer provided to it, then this may lead to a buffer overread
in the caller.

Stop this by adding a check for it in the hwrng core.

Reported-by: Guangwu Zhang <guazhang@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 57c51efa56131..018316f546215 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -181,8 +181,15 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
 	int present;
 
 	BUG_ON(!mutex_is_locked(&reading_mutex));
-	if (rng->read)
-		return rng->read(rng, (void *)buffer, size, wait);
+	if (rng->read) {
+		int err;
+
+		err = rng->read(rng, buffer, size, wait);
+		if (WARN_ON_ONCE(err > 0 && err > size))
+			err = size;
+
+		return err;
+	}
 
 	if (rng->data_present)
 		present = rng->data_present(rng, wait);