]> git.baikalelectronics.ru Git - kernel.git/commit
random: Fix crashes with sparse node ids
authorMichael Ellerman <mpe@ellerman.id.au>
Sat, 30 Jul 2016 14:23:08 +0000 (00:23 +1000)
committerLinus Torvalds <torvalds@linux-foundation.org>
Sun, 31 Jul 2016 04:00:06 +0000 (21:00 -0700)
commit0c3e74ee434e842eb2208d0d1f591d12ed7b5d43
treef0a655622dc3e030c2f12388f07bfafd20e2b049
parent5849af001fb222c8777a07c56bff0bb6b7ba7a91
random: Fix crashes with sparse node ids

On a system with sparse node ids, eg. a powerpc system with 4 nodes
numbered like so:

  node   0: [mem 0x0000000000000000-0x00000007ffffffff]
  node   1: [mem 0x0000000800000000-0x0000000fffffffff]
  node  16: [mem 0x0000001000000000-0x00000017ffffffff]
  node  17: [mem 0x0000001800000000-0x0000001fffffffff]

The code in rand_initialize() will allocate 4 pointers for the pool
array, and initialise them correctly.

However when go to use the pool, in eg. extract_crng(), we use the
numa_node_id() to index into the array. For the higher numbered node ids
this leads to random memory corruption, depending on what was kmalloc'ed
adjacent to the pool array.

Fix it by using nr_node_ids to size the pool array.

Fixes: e1b316c90397 ("random: make /dev/urandom scalable for silly userspace programs")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/char/random.c