HomeFreeBSD

Fortuna: Fix a race to prevent reseed spamming

Description

Fortuna: Fix a race to prevent reseed spamming

If multiple threads enter fortuna_pre_read contemporaneously, such as via
read(2) or getrandom(2), they could race to check how long it has been since
the last update due to a TOCTOU problem with 'now'.

Here is an example problematic execution:

Thread A: Thread B:
now_A = getsbinuptime();

now_B = getsbinuptime();  // now_B > now_A
RANDOM_RESEED_LOCK();
if (now - fs_lasttime > SBT_1S/10) {
        fs_lasttime = now;
        ... // reseed
}
RANDOM_RESEED_UNLOCK();

RANDOM_RESEED_LOCK();
if (now_A - fs_lasttime > SBT_1S/10) // now_A - fs_lasttime underflows

fs_lasttime = now_A;
... // reseed again, despite less than 100ms elapsing

}
RANDOM_RESEED_UNLOCK();

To resolve the race, simply check the current time after we win the lock
race.

If getsbinuptime is perceived to be expensive, another option might be to
just accept the race and validate that fs_lasttime isn't "in the future."
(It should be within the last ~2^31 seconds out of ~2^32 seconds
representable duration.)

Reviewed by: delphij, markm
Approved by: secteam (delphij)
Sponsored by: Dell EMC Isilon
Differential Revision: https://reviews.freebsd.org/D16984
(cherry picked from commit 5528565a76f5caae336d4f13213108dc1fad4ae0)

Details

Provenance
cemAuthored on Oct 20 2018, 9:09 PM
obrienCommitted on Aug 6 2021, 5:12 AM
Reviewer
delphij
Differential Revision
D16984: Fortuna: Fix a race to prevent reseed spamming
Parents
R10:b00de27cfc8d: Fortuna: trivial static variable cleanup
Branches
Unknown
Tags
Unknown