⬢ DragonFlyBSD Kernel Audit
DF-5707 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
diff --git a/sys/dev/misc/syscons/fire/fire_saver.c b/sys/dev/misc/syscons/fire/fire_saver.c
index 2acf29d..1bb9c1e 100644
--- a/sys/dev/misc/syscons/fire/fire_saver.c
+++ b/sys/dev/misc/syscons/fire/fire_saver.c
@@ -86,7 +86,7 @@ fire_saver(video_adapter_t *adp, int blank)
 	}
 	/* make a new bottom line */
 	for (x = 0, y = Y_SIZE; x < X_SIZE; x++)
-	    buf[x + (y * X_SIZE)] = krandom() % 160 + 96;
+	    buf[x + (y * X_SIZE)] = karc4random() % 160 + 96;
 
 	/* fade the flames out */
 	for (y = 0; y < Y_SIZE; y++) {
diff --git a/sys/dev/misc/syscons/rain/rain_saver.c b/sys/dev/misc/syscons/rain/rain_saver.c
index 824f41e..1d54b43 100644
--- a/sys/dev/misc/syscons/rain/rain_saver.c
+++ b/sys/dev/misc/syscons/rain/rain_saver.c
@@ -84,7 +84,7 @@ rain_saver(video_adapter_t *adp, int blank)
 	    crit_exit();
 	    bzero(vid, SCRW*SCRH);
 	    for (i = 0; i < SCRW; i += 2)
-		vid[i] = 1 + (krandom() % RAINMAX);
+		vid[i] = 1 + (karc4random() % RAINMAX);
 	    for (j = 1, k = SCRW; j < SCRH; j++)
 		for (i = 0; i < SCRW; i += 2, k += 2)
 		    vid[k] = (vid[k-SCRW] < RAINMAX) ? 1 + vid[k-SCRW] : 1;
diff --git a/sys/dev/misc/syscons/warp/warp_saver.c b/sys/dev/misc/syscons/warp/warp_saver.c
index 4292e5c..c385258 100644
--- a/sys/dev/misc/syscons/warp/warp_saver.c
+++ b/sys/dev/misc/syscons/warp/warp_saver.c
@@ -118,7 +118,7 @@ warp_init(video_adapter_t *adp)
 
     /* randomize the star field */
     for (i = 0; i < STARS; i++) {
-	star[i] = krandom() % (SCRW*SCRH);
+	star[i] = karc4random() % (SCRW*SCRH);
     }
     
     blanked = 0;
diff --git a/sys/libkern/random.c b/sys/libkern/random.c
index dbe4631..da3f690 100644
--- a/sys/libkern/random.c
+++ b/sys/libkern/random.c
@@ -45,6 +45,10 @@ skrandom(u_long seed)
  * Pseudo-random number generator for randomizing the profiling clock,
  * and whatever else we might use it for.  The result is uniform on
  * [0, 2^31 - 1].
+ *
+ * NOT for security-sensitive or observer-visible values: the entire
+ * state is the output and it is shared across every consumer in the
+ * kernel.  Use karc4random()/read_random() for those.
  */
 u_long
 krandom(void)
diff --git a/sys/net/dummynet/ip_dummynet.c b/sys/net/dummynet/ip_dummynet.c
index ecad5f4..7c2479e 100644
--- a/sys/net/dummynet/ip_dummynet.c
+++ b/sys/net/dummynet/ip_dummynet.c
@@ -1075,7 +1075,7 @@ dummynet_io(struct mbuf *m)
     q->tot_bytes += len;
     q->tot_pkts++;
 
-    if (fs->plr && krandom() < fs->plr)
+    if (fs->plr && karc4random() < fs->plr)
 	goto dropit;	/* Random pkt drop */
 
     if (fs->flags_fs & DN_QSIZE_IS_BYTES) {
diff --git a/sys/net/dummynet3/ip_dummynet3.c b/sys/net/dummynet3/ip_dummynet3.c
index 5ba58d2..81d121b 100644
--- a/sys/net/dummynet3/ip_dummynet3.c
+++ b/sys/net/dummynet3/ip_dummynet3.c
@@ -1094,7 +1094,7 @@ dummynet_io(struct mbuf *m)
 	q->tot_bytes += len;
 	q->tot_pkts++;
 
-	if (fs->plr && krandom() < fs->plr)
+	if (fs->plr && karc4random() < fs->plr)
 		goto dropit;	/* Random pkt drop */
 
 	if (fs->flags_fs & DN_QSIZE_IS_BYTES) {
diff --git a/sys/net/ipfw/ip_fw2.c b/sys/net/ipfw/ip_fw2.c
index f047fe0..f0ce3ee 100644
--- a/sys/net/ipfw/ip_fw2.c
+++ b/sys/net/ipfw/ip_fw2.c
@@ -3950,7 +3950,7 @@ check_body:
 				break;
 
 			case O_PROB:
-				match = (krandom() <
+				match = (karc4random() <
 					((ipfw_insn_u32 *)cmd)->d[0]);
 				break;