USB: chaoskey read offset bug
authorAlexander Inyukhin <shurick@sectorb.msk.ru>
Sat, 26 Sep 2015 12:24:21 +0000 (15:24 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 4 Oct 2015 10:01:13 +0000 (11:01 +0100)
Rng reads in chaoskey driver could return the same data under
the certain conditions.

Signed-off-by: Alexander Inyukhin <shurick@sectorb.msk.ru>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/misc/chaoskey.c

index 3ad5d19e4d04ede93fb8bc34debdbb9fcf2f4704..23c794813e6a923bff5b0a3719abbea860ee416d 100644 (file)
@@ -472,7 +472,7 @@ static int chaoskey_rng_read(struct hwrng *rng, void *data,
        if (this_time > max)
                this_time = max;
 
-       memcpy(data, dev->buf, this_time);
+       memcpy(data, dev->buf + dev->used, this_time);
 
        dev->used += this_time;