mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 12:52:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

hwrng: core - fix rng list on registration error

Browse Source 
hwrng_register(rng) does the following:

1. Checks if rng has name and read methods set
2. Checks if the name already exists
3. Adds rng to global rng_list
4. May try to set rng to current_rng

If step 4 fails, it returns an error. However, it does not remove the
rng from rng_list, causing a dangling reference which can result in
use-after-free if the caller frees rng, since registration failed.

Add a list_del_init() cleanup step.

Fixes: 2bbb698388 ("hwrng: use rng source with best quality")
Signed-off-by: Manos Pitsidianakis <manos@pitsidianak.is>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Manos Pitsidianakis
2026-06-05 14:23:51 +03:00
committed by Herbert Xu
parent ba16486d79
commit 3a5834db2b
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/char/hw_random/core.c
View File

@@ -596,11 +596,13 @@ int hwrng_register(struct hwrng *rng)
*/
err = set_current_rng(rng);
if (err)
goto out_unlock;
goto out_list_del;
}
}
mutex_unlock(&rng_mutex);
return 0;
out_list_del:
list_del_init(&rng->list);
out_unlock:
mutex_unlock(&rng_mutex);
out: