diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2017-02-26 01:21:33 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-04-24 10:29:26 +0300 |
| commit | b4d09fec3780bce6ea3e382c08b44c8f7c76fa22 (patch) | |
| tree | 5adf46b99c5c6ac5919a3e1d9a10cac779fadddb /drivers/char | |
| parent | f0522f31a20e742bb544df2e559e8e93312f718d (diff) | |
| download | linux-b4d09fec3780bce6ea3e382c08b44c8f7c76fa22.tar.xz | |
random: use a tighter cap in credit_entropy_bits_safe()
commit 9f886f4d1d292442b2f22a0a33321eae821bde40 upstream.
This fixes a harmless UBSAN where root could potentially end up
causing an overflow while bumping the entropy_total field (which is
ignored once the entropy pool has been initialized, and this generally
is completed during the boot sequence).
This is marginal for the stable kernel series, but it's a really
trivial patch, and it fixes UBSAN warning that might cause security
folks to get overly excited for no reason.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: Chen Feng <puck.chen@hisilicon.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/random.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/random.c b/drivers/char/random.c index 6fa0efa48cc5..4ba5c7e4e254 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -704,7 +704,7 @@ retry: static void credit_entropy_bits_safe(struct entropy_store *r, int nbits) { - const int nbits_max = (int)(~0U >> (ENTROPY_SHIFT + 1)); + const int nbits_max = r->poolinfo->poolwords * 32; /* Cap the value to avoid overflows */ nbits = min(nbits, nbits_max); |