From 4f5704ea347e52ac3f272d1341da10aed6e9973e Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Tue, 10 Dec 2024 16:17:06 +0100 Subject: powerpc: Use correct procedure call standard for getrandom vDSO call (bug 32440) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A plain indirect function call does not work on POWER because success and failure are signaled through a flag register, and not via the usual Linux negative return value convention. This has potential security impact, in two ways: the return value could be out of bounds (EAGAIN is 11 on powerpc6le), and no random bytes have been written despite the non-error return value. Fixes commit 461cab1de747f3842f27a5d24977d78d561d45f9 ("linux: Add support for getrandom vDSO"). Reported-by: Ján Stanček Reviewed-by: Carlos O'Donell --- sysdeps/unix/sysv/linux/getrandom.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) (limited to 'sysdeps/unix/sysv') diff --git a/sysdeps/unix/sysv/linux/getrandom.c b/sysdeps/unix/sysv/linux/getrandom.c index c8c5782..0dc8fa6 100644 --- a/sysdeps/unix/sysv/linux/getrandom.c +++ b/sysdeps/unix/sysv/linux/getrandom.c @@ -20,6 +20,8 @@ #include #include #include +#include +#include static inline ssize_t getrandom_syscall (void *buffer, size_t length, unsigned int flags, @@ -201,11 +203,12 @@ getrandom_vdso (void *buffer, size_t length, unsigned int flags, bool cancel) cancellation bridge (__syscall_cancel_arch), use GRND_NONBLOCK so there is no potential unbounded blocking in the kernel. It should be a rare situation, only at system startup when RNG is not initialized. */ - ssize_t ret = GLRO (dl_vdso_getrandom) (buffer, - length, - flags | GRND_NONBLOCK, - state, - state_size); + long int ret = INTERNAL_VSYSCALL_CALL (GLRO (dl_vdso_getrandom), 5, + buffer, + length, + flags | GRND_NONBLOCK, + state, + state_size); if (INTERNAL_SYSCALL_ERROR_P (ret)) { /* Fallback to the syscall if the kernel would block. */ @@ -241,7 +244,9 @@ __getrandom_early_init (_Bool initial) uint32_t mmap_flags; uint32_t reserved[13]; } params; - if (GLRO(dl_vdso_getrandom) (NULL, 0, 0, ¶ms, ~0UL) == 0) + long int ret = INTERNAL_VSYSCALL_CALL (GLRO(dl_vdso_getrandom), + 5, NULL, 0, 0, ¶ms, ~0UL); + if (! INTERNAL_SYSCALL_ERROR_P (ret)) { /* Align each opaque state to L1 data cache size to avoid false sharing. If the size can not be obtained, use the kernel -- cgit v1.1