| From 16287397ec5c08aa58db6acf7dbc55470d78087d Mon Sep 17 00:00:00 2001 |
| From: Ondrej Mosnacek <omosnace@redhat.com> |
| Date: Tue, 3 May 2022 13:50:10 +0200 |
| Subject: crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ |
| |
| From: Ondrej Mosnacek <omosnace@redhat.com> |
| |
| commit 16287397ec5c08aa58db6acf7dbc55470d78087d upstream. |
| |
| The commit referenced in the Fixes tag removed the 'break' from the else |
| branch in qcom_rng_read(), causing an infinite loop whenever 'max' is |
| not a multiple of WORD_SZ. This can be reproduced e.g. by running: |
| |
| kcapi-rng -b 67 >/dev/null |
| |
| There are many ways to fix this without adding back the 'break', but |
| they all seem more awkward than simply adding it back, so do just that. |
| |
| Tested on a machine with Qualcomm Amberwing processor. |
| |
| Fixes: a680b1832ced ("crypto: qcom-rng - ensure buffer for generate is completely filled") |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> |
| Reviewed-by: Brian Masney <bmasney@redhat.com> |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/crypto/qcom-rng.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/drivers/crypto/qcom-rng.c |
| +++ b/drivers/crypto/qcom-rng.c |
| @@ -65,6 +65,7 @@ static int qcom_rng_read(struct qcom_rng |
| } else { |
| /* copy only remaining bytes */ |
| memcpy(data, &val, max - currsize); |
| + break; |
| } |
| } while (currsize < max); |
| |