Herbert Xu d851192f10 hwrng: core - Fix page fault dead lock on mmap-ed hwrng ... commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis@qq.com> Reported-by: syzbot+c52ab18308964d248092@syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable@vger.kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-11-18 12:12:55 +01:00
..
amd-rng.c
atmel-rng.c
ba431-rng.c
bcm2835-rng.c
cavium-rng-vf.c
cavium-rng.c
cctrng.c
cctrng.h
core.c	hwrng: core - Fix page fault dead lock on mmap-ed hwrng	2024-11-18 12:12:55 +01:00
exynos-trng.c
exyswd-rng.c
geode-rng.c
hisi-rng.c
hisi-trng-v2.c
imx-rngc.c
ingenic-rng.c
ingenic-trng.c
intel-rng.c
iproc-rng200.c
ixp4xx-rng.c
Kconfig
ks-sa-rng.c
Makefile
meson-rng.c
mtk-rng.c
mxc-rnga.c
n2-asm.S
n2-drv.c
n2rng.h
nomadik-rng.c
npcm-rng.c
octeon-rng.c
omap-rng.c
omap3-rom-rng.c
optee-rng.c
pasemi-rng.c
pic32-rng.c
powernv-rng.c
pseries-rng.c
s390-trng.c
st-rng.c
stm32-rng.c
timeriomem-rng.c
tx4939-rng.c
via-rng.c
virtio-rng.c
xgene-rng.c
xiphera-trng.c