Repository navigation
crypto/rand: cap getrandom reads to ~32 MB per call on Linux #20877
Description
What version of Go are you using (go version)?
The problem is obvious from inspection of the source code and the documented Linux getrandom semantics, I looked at master.
What operating system and processor architecture are you using (go env)?
This affects all Linux platforms with support for the getrandom() system call.
What did you do?
Looked at the code to see if crypto/rand was correct or not.
What did you expect to see?
getrandom() used correctly.
What did you see instead?
From the getrandom documentation:
When reading from the urandom source, a maximum of 33554431 bytes is returned by a single call to getrandom() on systems where int has a size of 32 bits.
From the system call implementation in drivers/char/random.c:
if (count > INT_MAX)
count = INT_MAX;
src/crypto/rand/rand_linux.go:getRandomLinux() will return false due to the truncated getrandom() output, and the caller will fall back to servicing the request by opening and reading from /dev/urandom.
While I would be inclined to agree that a Read that is 32 MiB - 1 bytes or larger is excessive and out of the ordinary, this still should be handled correctly or documented.
Activity
[-]crypto/rand reads excessive amounts of entropy for very large requests.[/-][+]crypto/rand: cap getrandom reads to ~32 MB per call on Linux[/+]bradfitz commentedon Jul 1, 2017
Thanks for the report.
mmcloughlin commentedon Jul 15, 2017
I just attended the Gophercon Contributor Workshop and thought this might be a manageable fix to take on.
I was looking around
drivers/char/random.cas @Yawning pointed out, but I don't think the offending line isif (count > INT_MAX) ...becauseINT_MAXis probably2^31-1. That line is here:https://github.com/torvalds/linux/blob/486088bc4689f826b80aa317b45ac9e42e8b25ee/drivers/char/random.c#L1916
The syscall definition delegates to
urandom_readwhich contains the linehttps://github.com/torvalds/linux/blob/486088bc4689f826b80aa317b45ac9e42e8b25ee/drivers/char/random.c#L1782
And
ENTROPY_SHIFTis 3 (defined near the top of the file). That explains why the limit is2^25-1rather than2^31-1.mmcloughlin commentedon Jul 16, 2017
I have been working on a patch. I'll put it out tomorrow for review.
gopherbot commentedon Jul 17, 2017
CL https://golang.org/cl/49170 mentions this issue.