Jason A. Donenfeld cc21ae9326 gcc-plugins: latent_entropy: use /dev/urandom ... commit c40160f2998c897231f8454bf797558d30a20375 upstream. While the latent entropy plugin mostly doesn't derive entropy from get_random_const() for measuring the call graph, when __latent_entropy is applied to a constant, then it's initialized statically to output from get_random_const(). In that case, this data is derived from a 64-bit seed, which means a buffer of 512 bits doesn't really have that amount of compile-time entropy. This patch fixes that shortcoming by just buffering chunks of /dev/urandom output and doling it out as requested. At the same time, it's important that we don't break the use of -frandom-seed, for people who want the runtime benefits of the latent entropy plugin, while still having compile-time determinism. In that case, we detect whether gcc's set_random_seed() has been called by making a call to get_random_seed(noinit=true) in the plugin init function, which is called after set_random_seed() is called but before anything that calls get_random_seed(noinit=false), and seeing if it's zero or not. If it's not zero, we're in deterministic mode, and so we just generate numbers with a basic xorshift prng. Note that we don't detect if -frandom-seed is being used using the documented local_tick variable, because it's assigned via: local_tick = (unsigned) tv.tv_sec * 1000 + tv.tv_usec / 1000; which may well overflow and become -1 on its own, and so isn't reliable: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105171 [kees: The 256 byte rnd_buf size was chosen based on average (250), median (64), and std deviation (575) bytes of used entropy for a defconfig x86_64 build] Fixes: 38addce8b6 ("gcc-plugins: Add latent_entropy plugin") Cc: stable@vger.kernel.org Cc: PaX Team <pageexec@freemail.hu> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220405222815.21155-1-Jason@zx2c4.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-04-20 09:23:26 +02:00
..
atomic	Merge branch 'kcsan' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into locking/core	2020-10-09 08:56:02 +02:00
basic	kbuild: introduce hostprogs-always-y and userprogs-always-y	2020-08-10 01:32:59 +09:00
clang-tools	gen_compile_commands: fix missing 'sys' package	2021-09-22 12:27:58 +02:00
coccinelle	Merge branch 'for-5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux	2020-10-18 14:20:35 -07:00
dtc	scripts/dtc: Call pkg-config POSIXly correct	2022-04-08 14:40:15 +02:00
dummy-tools	kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc	2021-12-14 11:32:46 +01:00
gcc-plugins	gcc-plugins: latent_entropy: use /dev/urandom	2022-04-20 09:23:26 +02:00
gdb	scripts/gdb/tasks: add headers and improve spacing format	2020-10-16 11:11:22 -07:00
genksyms	genksyms: keywords: Use __restrict not _restrict	2020-08-18 20:16:46 +09:00
kconfig	kconfig: fix failing to generate auto.conf	2022-02-23 12:01:07 +01:00
ksymoops
mod	kbuild: generate Module.symvers only when vmlinux exists	2021-05-19 10:12:59 +02:00
package	builddeb: Fix rootless build in setuid/setgid directory	2020-11-02 11:31:00 +09:00
selinux	scripts/selinux,selinux: update mdp to enable policy capabilities	2020-08-17 20:42:00 -04:00
tracing	scripts/tracing: fix the bug that can't parse raw_trace_func	2021-08-12 13:22:12 +02:00
.gitignore	kbuild: preprocess module linker script	2020-09-25 00:36:41 +09:00
adjust_autoksyms.sh
asn1_compiler.c
bin2c.c
bloat-o-meter	scripts: switch explicitly to Python 3	2021-05-22 11:40:55 +02:00
bootgraph.pl
bpf_helpers_doc.py	bpf: Add struct bpf_redir_neigh forward declaration to BPF helper defs	2020-10-29 15:19:04 +01:00
cc-can-link.sh
check_extable.sh
check-sysctl-docs
checkincludes.pl
checkkconfigsymbols.py	kconfig: remove '---help---' support	2020-08-14 13:30:03 +09:00
checkpatch.pl	checkpatch: fix unescaped left brace	2020-12-30 11:53:56 +01:00
checkstack.pl	scripts/checkstack.pl: fix arm sp regex	2020-05-26 00:03:16 +09:00
checksyscalls.sh
checkversion.pl
clang-version.sh
cleanfile
cleanpatch
coccicheck	scripts: coccicheck: Change default condition for parallelism	2020-10-12 10:37:56 +02:00
config	tweewide: Fix most Shebang lines	2021-05-22 11:40:55 +02:00
const_structs.checkpatch	const_structs.checkpatch: add pinctrl_ops and pinmux_ops	2020-10-16 11:11:21 -07:00
decode_stacktrace.sh	scripts/decode_stacktrace.sh: guess path to vmlinux by release name	2020-08-07 11:33:21 -07:00
decodecode	scripts/decodecode: add the capability to supply the program counter	2020-10-13 18:38:26 -07:00
depmod.sh	depmod: handle the case of /sbin/depmod without /sbin in PATH	2021-01-12 20:18:16 +01:00
dev-needs.sh	scripts/dev-needs: Add script to list device dependencies	2020-09-04 18:19:37 +02:00
diffconfig	scripts: switch explicitly to Python 3	2021-05-22 11:40:55 +02:00
documentation-file-ref-check
export_report.pl
extract_xc3028.pl
extract-cert.c	extract-cert: add static to local data	2020-08-18 20:16:46 +09:00
extract-ikconfig
extract-module-sig.pl
extract-sys-certs.pl
extract-vmlinux
faddr2line
file-size.sh
find-unused-docs.sh
gcc-goto.sh
gcc-ld
gcc-version.sh
gcc-x86_32-has-stack-protector.sh
gcc-x86_64-has-stack-protector.sh
gen_autoksyms.sh	kbuild: fix CONFIG_TRIM_UNUSED_KSYMS build for ppc64	2021-02-26 10:13:01 +01:00
gen_ksymdeps.sh	kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y	2021-09-18 13:40:16 +02:00
get_abi.pl	tweewide: Fix most Shebang lines	2021-05-22 11:40:55 +02:00
get_dvb_firmware
get_maintainer.pl	get_maintainer: exclude MAINTAINERS file(s) from --git-fallback	2020-10-16 11:11:19 -07:00
gfp-translate
headerdep.pl
headers_check.pl
headers_install.sh	Merge branch 'work.fdpic' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-08-07 13:29:39 -07:00
insert-sys-cert.c
jobserver-exec
kallsyms.c	kallsyms: fix nonconverging kallsyms table with lld	2021-02-17 11:02:24 +01:00
Kbuild.include	kbuild: sink stdout from cmd for silent build	2021-07-25 14:36:12 +02:00
Kconfig.include	kconfig: unify cc-option and as-option	2020-06-17 10:38:42 +09:00
kernel-doc	scripts: kernel-doc: fix parsing function-like typedefs	2020-12-30 11:53:33 +01:00
ld-version.sh
leaking_addresses.pl	leaking_addresses: Always print a trailing newline	2021-11-18 14:03:57 +01:00
Lindent
link-vmlinux.sh	Kbuild updates for v5.10	2020-10-22 13:13:57 -07:00
lld-version.sh	scripts/lld-version.sh: Rewrite based on upstream ld-version.sh	2021-11-21 13:46:37 +01:00
Makefile	certs: Add ability to preload revocation certs	2021-06-30 08:47:30 -04:00
Makefile.asm-generic
Makefile.build	kbuild: Fix objtool dependency for 'OBJECT_FILES_NON_STANDARD_<obj> := n'	2021-07-14 16:56:04 +02:00
Makefile.clean	kbuild: introduce hostprogs-always-y and userprogs-always-y	2020-08-10 01:32:59 +09:00
Makefile.dtbinst
Makefile.extrawarn	Makefile.extrawarn: Move -Wunaligned-access to W=1	2022-02-16 12:54:30 +01:00
Makefile.gcc-plugins	gcc-plugins/structleak: add makefile var for disabling structleak	2021-10-27 09:56:54 +02:00
Makefile.headersinst
Makefile.host	kbuild: sort hostprogs before passing it to ifneq	2020-08-10 01:32:59 +09:00
Makefile.kasan	kasan: fix hwasan build for gcc	2021-04-28 13:40:02 +02:00
Makefile.kcov	kbuild: include scripts/Makefile.* only when relevant CONFIG is enabled	2020-08-10 01:32:59 +09:00
Makefile.kcsan	Kbuild updates for v5.10	2020-10-22 13:13:57 -07:00
Makefile.lib	dt-bindings: Use json for processed-schema*	2020-08-19 14:31:57 -06:00
Makefile.modfinal	kbuild: preprocess module linker script	2020-09-25 00:36:41 +09:00
Makefile.modinst
Makefile.modpost	kbuild: generate Module.symvers only when vmlinux exists	2021-05-19 10:12:59 +02:00
Makefile.modsign
Makefile.package	kbuild: fix broken builds because of GZIP,BZIP2,LZOP variables	2020-06-11 20:14:41 +09:00
Makefile.ubsan	ubsan: remove CONFIG_UBSAN_OBJECT_SIZE	2022-04-13 21:01:10 +02:00
Makefile.userprogs	kbuild: add infrastructure to build userspace programs	2020-05-17 18:52:01 +09:00
makelst
markup_oops.pl
mkcompile_h	kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set	2021-07-25 14:36:16 +02:00
mkmakefile
mksysmap	mksysmap: Fix the mismatch of '.L' symbols in System.map	2020-06-06 23:39:20 +09:00
mkuboot.sh
module.lds.S	kbuild: lto: Merge module sections if and only if CONFIG_LTO_CLANG is enabled	2022-02-23 12:01:00 +01:00
modules-check.sh	kbuild: make module name conflict fatal error	2020-05-26 00:03:16 +09:00
nsdeps	scripts: add dummy report mode to add_namespace.cocci	2020-07-10 14:19:58 +02:00
objdiff
parse-maintainers.pl
patch-kernel
profile2linkerlist.pl
prune-kernel
recordmcount.c	ftrace: Have recordmcount use w8 to read relp->r_info in arm64_is_fake_mcount	2021-03-09 11:11:14 +01:00
recordmcount.h	recordmcount: Correct st_shndx handling	2021-06-30 08:47:23 -04:00
recordmcount.pl	recordmcount.pl: fix typo in s390 mcount regex	2022-01-05 12:40:29 +01:00
setlocalversion	scripts/setlocalversion: make git describe output more reliable	2020-09-25 02:28:12 +09:00
show_delta	tweewide: Fix most Shebang lines	2021-05-22 11:40:55 +02:00
sign-file.c
sorttable.c	s390/kernel: expand exception table logic to allow new handling options	2020-07-20 10:55:50 +02:00
sorttable.h
spdxcheck-test.sh
spdxcheck.py	scripts/spdxcheck.py: handle license identifiers in XML comments	2020-10-02 11:31:26 +02:00
spelling.txt	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2020-10-15 15:11:56 -07:00
sphinx-pre-install	scripts: sphinx-pre-install: Fix ctex support on Debian	2022-01-27 10:54:36 +01:00
split-man.pl	tweewide: Fix most Shebang lines	2021-05-22 11:40:55 +02:00
stackdelta
stackusage
subarch.include
tags.sh	Merge branch 'locking/urgent' into locking/core, to pick up fixes	2020-10-09 08:55:17 +02:00
tools-support-relr.sh	Makefile: fix GDB warning with CONFIG_RELR	2021-07-14 16:55:53 +02:00
unifdef.c
ver_linux
xen-hypercalls.sh
xz_wrap.sh	kbuild: add variables for compression tools	2020-06-06 23:42:01 +09:00