korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-27 14:14:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

hardening fixes for v5.18-rc3

Browse Source 
- latent_entropy: Use /dev/urandom instead of small GCC seed (Jason Donenfeld)
 
 - uapi/stddef.h: add missed include guards (Tadeusz Struk)
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAmJWDFgWHGtlZXNjb29r
 QGNocm9taXVtLm9yZwAKCRCJcvTf3G3AJjWiD/wPExrq+Ph3jWj/3h+5Na8EdkNq
 8z96VErdrR5rNUDbtnLWmgy0hjoQAh1deRJBcv0TX+3W8XO6ynXx2+gCPqKq7hc3
 9dIDS9o67ZuMZircoaxkULtnqqX/4Bi7m1uiUhIwsbFKONkHLPr1wW2gdx2VlPMh
 S0zrV5nY6ey0rLCN1i+ILXKb7VwuLa7tSObrv9TGn4ZpVIZTIn+ewM61WLKpI61A
 N9NbIlg8NlW5od8IvvAnwVRdjsR+90trYPYF+3HlWiDIRw2OHz0KdkrEtkzlrSn0
 69aTD5Ff7UusPHX2vtHa9+MznkAUmkW1i5AXB+vo2O5DjRZ6+Br5bResfyln2oCq
 WOciA6KhdiFtplPr4NwRaqw9NT7bwB793oIG6cTBf55+KvKL6UZmsWFwIr8QsmVb
 TZ7A9hKKpBXWT3qf9yTYTL1DxzDCtYOHXzdjdwfeTkrCf1pt/L2SqQdHh3ouQf+s
 rTArpSZ1gP9CXSQbuqh0oNnpUPrVRDTvbGZOLNKa1k7tzlMXG51ebwWWEPfNt5EY
 LZA9W/RLp3gtkzU0K8IP/oP993gpLekiu/aA7nCZwSb4g2qTUkX5Y0qVnUqyQaKe
 pcfYLvVZPPVigUZ7TODSQSJs1/8/xEuSpoSrEi7eZTckyq8inVtKlsPSY/SRy/Sz
 9XVCiN1fKUvB+p5X3Q==
 =gVfg
 -----END PGP SIGNATURE-----

Merge tag 'hardening-v5.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull hardening fixes from Kees Cook:

 - latent_entropy: Use /dev/urandom instead of small GCC seed (Jason
   Donenfeld)

 - uapi/stddef.h: add missed include guards (Tadeusz Struk)

* tag 'hardening-v5.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  gcc-plugins: latent_entropy: use /dev/urandom
  uapi/linux/stddef.h: Add include guards
This commit is contained in:
Linus Torvalds 2022-04-12 14:29:40 -10:00
commit a19944809f
2 changed files with 31 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
include/uapi/linux/stddef.h
View File

@ -1,4 +1,7 @@
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef _UAPI_LINUX_STDDEF_H
#define _UAPI_LINUX_STDDEF_H
#include <linux/compiler_types.h> #include <linux/compiler_types.h>
#ifndef __always_inline #ifndef __always_inline
@ -41,3 +44,4 @@
struct { } __empty_ ## NAME; \ struct { } __empty_ ## NAME; \
TYPE NAME[]; \ TYPE NAME[]; \
} }
#endif

44
scripts/gcc-plugins/latent_entropy_plugin.c
View File

@ -86,25 +86,31 @@ static struct plugin_info latent_entropy_plugin_info = {
.help = "disable\tturn off latent entropy instrumentation\n", .help = "disable\tturn off latent entropy instrumentation\n",
}; };
static unsigned HOST_WIDE_INT seed; static unsigned HOST_WIDE_INT deterministic_seed;
/* static unsigned HOST_WIDE_INT rnd_buf[32];
* get_random_seed() (this is a GCC function) generates the seed. static size_t rnd_idx = ARRAY_SIZE(rnd_buf);
* This is a simple random generator without any cryptographic security because static int urandom_fd = -1;
* the entropy doesn't come from here.
*/
static unsigned HOST_WIDE_INT get_random_const(void) static unsigned HOST_WIDE_INT get_random_const(void)
{ {
unsigned int i; if (deterministic_seed) {
unsigned HOST_WIDE_INT ret = 0; unsigned HOST_WIDE_INT w = deterministic_seed;
w ^= w << 13;
for (i = 0; i < 8 * sizeof(ret); i++) { w ^= w >> 7;
ret = (ret << 1) | (seed & 1); w ^= w << 17;
seed >>= 1; deterministic_seed = w;
if (ret & 1) return deterministic_seed;
seed ^= 0xD800000000000000ULL;
} }
return ret; if (urandom_fd < 0) {
urandom_fd = open("/dev/urandom", O_RDONLY);
gcc_assert(urandom_fd >= 0);
}
if (rnd_idx >= ARRAY_SIZE(rnd_buf)) {
gcc_assert(read(urandom_fd, rnd_buf, sizeof(rnd_buf)) == sizeof(rnd_buf));
rnd_idx = 0;
}
return rnd_buf[rnd_idx++];
} }
static tree tree_get_random_const(tree type) static tree tree_get_random_const(tree type)
@ -537,8 +543,6 @@ static void latent_entropy_start_unit(void *gcc_data __unused,
tree type, id; tree type, id;
int quals; int quals;
seed = get_random_seed(false);
if (in_lto_p) if (in_lto_p)
return; return;
@ -573,6 +577,12 @@ __visible int plugin_init(struct plugin_name_args *plugin_info,
const struct plugin_argument * const argv = plugin_info->argv; const struct plugin_argument * const argv = plugin_info->argv;
int i; int i;
/*
* Call get_random_seed() with noinit=true, so that this returns
* 0 in the case where no seed has been passed via -frandom-seed.
*/
deterministic_seed = get_random_seed(true);
static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy[] = { static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy[] = {
{ {
.base = &latent_entropy_decl, .base = &latent_entropy_decl,