Commit 68061232 authored by Ondrej Mosnacek's avatar Ondrej Mosnacek Committed by GUO Zihua
Browse files

crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ

stable inclusion
from stable-v4.19.245
commit 71a89789552b7faf3ef27969b9bc783fa0df3550
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I963JJ
CVE: CVE-2022-48630

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=71a89789552b7faf3ef27969b9bc783fa0df3550



--------------------------------

commit 16287397 upstream.

The commit referenced in the Fixes tag removed the 'break' from the else
branch in qcom_rng_read(), causing an infinite loop whenever 'max' is
not a multiple of WORD_SZ. This can be reproduced e.g. by running:

    kcapi-rng -b 67 >/dev/null

There are many ways to fix this without adding back the 'break', but
they all seem more awkward than simply adding it back, so do just that.

Tested on a machine with Qualcomm Amberwing processor.

Fixes: a680b183 ("crypto: qcom-rng - ensure buffer for generate is completely filled")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
Reviewed-by: default avatarBrian Masney <bmasney@redhat.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarGUO Zihua <guozihua@huawei.com>
parent 2a17d9bd
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment