random: fix bound check ordering (CVE-2007-3105)
random: fix bound check ordering (CVE-2007-3105)

If root raised the default wakeup threshold over the size of the
output pool, the pool transfer function could overflow the stack with
RNG bytes, causing a DoS or potential privilege escalation.

(Bug reported by the PaX Team <pageexec@freemail.hu>)

Cc: Theodore Tso <4ed386e0495d3e109932df055831d9ec2f824927@mit.edu>
Cc: Willy Tarreau <aff024fe4ab0fece4091de044c58c9ae4233383a@1wt.eu>
Signed-off-by: Matt Mackall <4121265491a72225438dfd0e91a228f361407ae2@selenic.com>
Signed-off-by: Chris Wright <e829bd48de90b6e1a1950750fa8ca2bb62f273d4@sous-sol.org>
Signed-off-by: Linus Torvalds <69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org>

KristFoundation/Programs,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas