@@ -31,6 +31,7 @@ static struct hwrng *current_rng;
/* the current rng has been explicitly chosen by user via sysfs */
static int cur_rng_set_by_user;
static struct task_struct *hwrng_fill;
+static struct completion hwrng_started = COMPLETION_INITIALIZER(hwrng_started);
/* list of registered rngs, sorted decending by quality */
static LIST_HEAD(rng_list);
/* Protects rng_list and current_rng */
@@ -432,12 +433,15 @@ static int hwrng_fillfn(void *unused)
{
long rc;
+ complete(&hwrng_started);
while (!kthread_should_stop()) {
struct hwrng *rng;
rng = get_current_rng();
- if (IS_ERR(rng) || !rng)
- break;
+ if (IS_ERR(rng) || !rng) {
+ msleep_interruptible(10000);
+ continue;
+ }
mutex_lock(&reading_mutex);
rc = rng_get_data(rng, rng_fillbuf,
rng_buffer_size(), 1);
@@ -462,6 +466,8 @@ static void start_khwrngd(void)
if (IS_ERR(hwrng_fill)) {
pr_err("hwrng_fill thread creation failed\n");
hwrng_fill = NULL;
+ } else {
+ wait_for_completion(&hwrng_started);
}
}
There are two issues with the management of the kernel thread to gather entropy: * it can terminate also if the rng is removed, and in this case it doesn't synchronize with kthread_should_stop(), but it directly sets hwrng_fill to NULL. If this happens after the NULL check but before kthread_stop() is called, we'll have a NULL pointer dereference. * if we have a register/unregister too fast, it can happen that the kthread is not yet started when kthread_stop is called, and this seems to leave a corrupted or uninitialized kthread struct. This is detected by the WARN_ON at kernel/kthread.c:75 and later causes a page domain fault. CC: Matt Mackall <mpm@selenic.com> CC: Herbert Xu <herbert@gondor.apana.org.au> CC: Colin Ian King <colin.king@canonical.com> CC: Holger Brunck <holger.brunck@hitachi-powergrids.com> CC: Valentin Longchamp <valentin.longchamp@hitachi-powergrids.com> Signed-off-by: Luca Dariz <luca.dariz@hitachi-powergrids.com> --- drivers/char/hw_random/core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)