| Message ID | 20220727143219.2684192-1-mpe@ellerman.id.au (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [v6,1/3] powerpc/powernv: Avoid crashing if rng is NULL | expand |
On Thu, 28 Jul 2022 00:32:17 +1000, Michael Ellerman wrote: > On a bare-metal Power8 system that doesn't have an "ibm,power-rng", a > malicious QEMU and guest that ignore the absence of the > KVM_CAP_PPC_HWRNG flag, and calls H_RANDOM anyway, will dereference a > NULL pointer. > > In practice all Power8 machines have an "ibm,power-rng", but let's not > rely on that, add a NULL check and early return in > powernv_get_random_real_mode(). > > [...] Applied to powerpc/next. [1/3] powerpc/powernv: Avoid crashing if rng is NULL https://git.kernel.org/powerpc/c/90b5d4fe0b3ba7f589c6723c6bfb559d9e83956a [2/3] powerpc/powernv/kvm: Use darn for H_RANDOM on Power9 https://git.kernel.org/powerpc/c/7ef3d06f1bc4a5e62273726f3dc2bd258ae1c71f [3/3] powerpc/powernv: rename remaining rng powernv_ functions to pnv_ https://git.kernel.org/powerpc/c/978030f054ff97d9079b35f0178e2013918fb316 cheers
diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c index 3805ad13b8f3..2287c9cd0cd5 100644 --- a/arch/powerpc/platforms/powernv/rng.c +++ b/arch/powerpc/platforms/powernv/rng.c @@ -63,6 +63,8 @@ int powernv_get_random_real_mode(unsigned long *v) struct powernv_rng *rng; rng = raw_cpu_read(powernv_rng); + if (!rng) + return 0; *v = rng_whiten(rng, __raw_rm_readq(rng->regs_real));
On a bare-metal Power8 system that doesn't have an "ibm,power-rng", a malicious QEMU and guest that ignore the absence of the KVM_CAP_PPC_HWRNG flag, and calls H_RANDOM anyway, will dereference a NULL pointer. In practice all Power8 machines have an "ibm,power-rng", but let's not rely on that, add a NULL check and early return in powernv_get_random_real_mode(). Cc: stable@vger.kernel.org # v4.1+ Fixes: e928e9cb3601 ("KVM: PPC: Book3S HV: Add fast real-mode H_RANDOM implementation.") Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> --- arch/powerpc/platforms/powernv/rng.c | 2 ++ 1 file changed, 2 insertions(+) v6: New patch, though change log based on Jason's original.