Commit 7b5164fb authored by Jason A. Donenfeld's avatar Jason A. Donenfeld
Browse files

random: zero buffer after reading entropy from userspace 



This buffer may contain entropic data that shouldn't stick around longer
than needed, so zero out the temporary buffer at the end of write_pool().

Reviewed-by: default avatarDominik Brodowski <linux@dominikbrodowski.net>
Reviewed-by: default avatarJann Horn <jannh@google.com>
Reviewed-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
parent 434537ae

drivers/char/random.c

+8 −3
Original line number Diff line number Diff line
@@ -1336,19 +1336,24 @@ static __poll_t random_poll(struct file *file, poll_table *wait) 
static int write_pool(const char __user *ubuf, size_t count)

{

	size_t len;

	int ret = 0;

	u8 block[BLAKE2S_BLOCK_SIZE];



	while (count) {

		len = min(count, sizeof(block));

		if (copy_from_user(block, ubuf, len))

			return -EFAULT;

		if (copy_from_user(block, ubuf, len)) {

			ret = -EFAULT;

			goto out;

		}

		count -= len;

		ubuf += len;

		mix_pool_bytes(block, len);

		cond_resched();

	}



	return 0;

out:

	memzero_explicit(block, sizeof(block));

	return ret;

}



static ssize_t random_write(struct file *file, const char __user *buffer,