This is a note to let you know that I've just added the patch titled
crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
to the 5.17-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
crypto-qcom-rng-fix-infinite-loop-on-requests-not-multiple-of-word_sz.patch
and it can be found in the queue-5.17 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 16287397ec5c08aa58db6acf7dbc55470d78087d Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
Date: Tue, 3 May 2022 13:50:10 +0200
Subject: crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
From: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
commit 16287397ec5c08aa58db6acf7dbc55470d78087d upstream.
The commit referenced in the Fixes tag removed the 'break' from the else
branch in qcom_rng_read(), causing an infinite loop whenever 'max' is
not a multiple of WORD_SZ. This can be reproduced e.g. by running:
kcapi-rng -b 67 >/dev/null
There are many ways to fix this without adding back the 'break', but
they all seem more awkward than simply adding it back, so do just that.
Tested on a machine with Qualcomm Amberwing processor.
Fixes: a680b1832ced ("crypto: qcom-rng - ensure buffer for generate is completely filled")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
Reviewed-by: Brian Masney <bmasney@xxxxxxxxxx>
Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/crypto/qcom-rng.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/crypto/qcom-rng.c
+++ b/drivers/crypto/qcom-rng.c
@@ -65,6 +65,7 @@ static int qcom_rng_read(struct qcom_rng
} else {
/* copy only remaining bytes */
memcpy(data, &val, max - currsize);
+ break;
}
} while (currsize < max);
Patches currently in stable-queue which might be from omosnace@xxxxxxxxxx are
queue-5.17/crypto-qcom-rng-fix-infinite-loop-on-requests-not-multiple-of-word_sz.patch
queue-5.17/selinux-fix-bad-cleanup-on-error-in-hashtab_duplicate.patch
