Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-10 14:11:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

mm/slab_common: Replace invocation of weak PRNG

Browse Source 
The Slab allocator randomization inside slab_common.c
uses the prandom_u32 PRNG. That was added to prevent attackers to obtain
information on the heap state.

However, this PRNG turned out to be weak, as noted in commit c51f8f88d7
To fix it, we have changed the invocation of prandom_u32_state to get_random_u32
to ensure the PRNG is strong.

Since a modulo operation is applied right after that,
in the Fisher-Yates shuffle, we used get_random_u32_below, to achieve uniformity.

Signed-off-by: David Keisar Schmidt <david.keisarschm@mail.huji.ac.il>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
This commit is contained in:
David Keisar Schmidt 2023-04-16 20:22:55 +03:00 committed by Vlastimil Babka
parent f7e466e951
commit ffe4dfe0ba
1 changed files with 3 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
mm/slab_common.c
View File

@ -1141,7 +1141,7 @@ EXPORT_SYMBOL(kmalloc_large_node);
#ifdef CONFIG_SLAB_FREELIST_RANDOM #ifdef CONFIG_SLAB_FREELIST_RANDOM
/* Randomize a generic freelist */ /* Randomize a generic freelist */
static void freelist_randomize(struct rnd_state *state, unsigned int *list, static void freelist_randomize(unsigned int *list,
unsigned int count) unsigned int count)
{ {
unsigned int rand; unsigned int rand;
@ -1152,8 +1152,7 @@ static void freelist_randomize(struct rnd_state *state, unsigned int *list,
/* Fisher-Yates shuffle */ /* Fisher-Yates shuffle */
for (i = count - 1; i > 0; i--) { for (i = count - 1; i > 0; i--) {
rand = prandom_u32_state(state); rand = get_random_u32_below(i + 1);
rand %= (i + 1);
swap(list[i], list[rand]); swap(list[i], list[rand]);
} }
} }
@ -1162,7 +1161,6 @@ static void freelist_randomize(struct rnd_state *state, unsigned int *list,
int cache_random_seq_create(struct kmem_cache *cachep, unsigned int count, int cache_random_seq_create(struct kmem_cache *cachep, unsigned int count,
gfp_t gfp) gfp_t gfp)
{ {
struct rnd_state state;
if (count < 2 || cachep->random_seq) if (count < 2 || cachep->random_seq)
return 0; return 0;
@ -1171,10 +1169,7 @@ int cache_random_seq_create(struct kmem_cache *cachep, unsigned int count,
if (!cachep->random_seq) if (!cachep->random_seq)
return -ENOMEM; return -ENOMEM;
/* Get best entropy at this stage of boot */ freelist_randomize(cachep->random_seq, count);
prandom_seed_state(&state, get_random_long());
freelist_randomize(&state, cachep->random_seq, count);
return 0; return 0;
} }