drivers/char/random.c: fix a race which can lead to a bogus BUG()

[linux-2.6-omap-h63xx.git] / drivers / char / random.c

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 1838aa3d24feac6a09b9516acbb1ffd623e7f2db..7ce1ac4baa6d81feccad163cb9c476edfb7278c9 100644 (file)
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -407,7 +407,7 @@ struct entropy_store {
        /* read-write data: */
        spinlock_t lock;
        unsigned add_ptr;
-       int entropy_count;
+       int entropy_count;      /* Must at no time exceed ->POOLBITS! */
        int input_rotate;
 };
 
@@ -520,6 +520,7 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
 static void credit_entropy_bits(struct entropy_store *r, int nbits)
 {
        unsigned long flags;
+       int entropy_count;
 
        if (!nbits)
                return;
@@ -527,20 +528,20 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits)
        spin_lock_irqsave(&r->lock, flags);
 
        DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
-       r->entropy_count += nbits;
-       if (r->entropy_count < 0) {
+       entropy_count = r->entropy_count;
+       entropy_count += nbits;
+       if (entropy_count < 0) {
                DEBUG_ENT("negative entropy/overflow\n");
-               r->entropy_count = 0;
-       } else if (r->entropy_count > r->poolinfo->POOLBITS)
-               r->entropy_count = r->poolinfo->POOLBITS;
+               entropy_count = 0;
+       } else if (entropy_count > r->poolinfo->POOLBITS)
+               entropy_count = r->poolinfo->POOLBITS;
+       r->entropy_count = entropy_count;
 
        /* should we wake readers? */
-       if (r == &input_pool &&
-           r->entropy_count >= random_read_wakeup_thresh) {
+       if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
                wake_up_interruptible(&random_read_wait);
                kill_fasync(&fasync, SIGIO, POLL_IN);
        }
-
        spin_unlock_irqrestore(&r->lock, flags);
 }