lkml.org 
[lkml]   [2007]   [Dec]   [15]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: /dev/urandom uses uninit bytes, leaks user data
From Valdis.Kletnieks@vt ...
DateSat, 15 Dec 2007 02:54:01 -0500
On Fri, 14 Dec 2007 23:20:30 PST, Matti Linnanvuori said:
> From: Matti Linnanvuori <mattilinnnvuori@yahoo.com>
> 
> /dev/urandom use no uninit bytes, leak no user data
> 
> Signed-off-by: Matti Linnanvuori <mattilinnnvuori@yahoo.com>
> 
> ---
> 
> --- a/drivers/char/random.c	2007-12-15 09:09:37.895414000 +0200
> +++ b/drivers/char/random.c	2007-12-15 09:12:02.607831500 +0200
> @@ -689,7 +689,7 @@ static ssize_t extract_entropy(struct en
>   */
>  static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
>  {
> -	__u32 tmp[OUTPUT_POOL_WORDS];
> +	static __u32 tmp[OUTPUT_POOL_WORDS];

This looks like a race waiting to happen - what lock is held so we don't have
'tmp' smashed by 2 instances on different CPUs (not a problem when each
instance lives on a hopefully separate stack)?
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2007-12-15 08:57    [from the cache]
©2003-2008