xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

random: use hash function for crng_slow_load()

Browse Source 
commit 66e4c2b9541503d721e936cc3898c9f25f4591ff upstream.

Since we have a hash function that's really fast, and the goal of
crng_slow_load() is reportedly to "touch all of the crng's state", we
can just hash the old state together with the new state and call it a
day. This way we dont need to reason about another LFSR or worry about
various attacks there. This code is only ever used at early boot and
then never again.

Cc: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jason A. Donenfeld
2022-02-08 19:23:17 +01:00
committed by Greg Kroah-Hartman
parent 95026060d8
commit 655a69cb41
1 changed files with 14 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
drivers/char/random.c
View File

@@ -477,42 +477,30 @@ static size_t crng_fast_load(const u8 *cp, size_t len)
* all), and (2) it doesn't have the performance constraints of * all), and (2) it doesn't have the performance constraints of
* crng_fast_load(). * crng_fast_load().
* *
* So we do something more comprehensive which is guaranteed to touch * So, we simply hash the contents in with the current key. Finally,
* all of the primary_crng's state, and which uses a LFSR with a * we do *not* advance crng_init_cnt since buffer we may get may be
* period of 255 as part of the mixing algorithm. Finally, we do * something like a fixed DMI table (for example), which might very
* *not* advance crng_init_cnt since buffer we may get may be something * well be unique to the machine, but is otherwise unvarying.
* like a fixed DMI table (for example), which might very well be
* unique to the machine, but is otherwise unvarying.
*/ */
static int crng_slow_load(const u8 *cp, size_t len) static void crng_slow_load(const u8 *cp, size_t len)
{ {
unsigned long flags; unsigned long flags;
static u8 lfsr = 1; struct blake2s_state hash;
u8 tmp;
unsigned int i, max = sizeof(base_crng.key); blake2s_init(&hash, sizeof(base_crng.key));
const u8 *src_buf = cp;
u8 *dest_buf = base_crng.key;
if (!spin_trylock_irqsave(&base_crng.lock, flags)) if (!spin_trylock_irqsave(&base_crng.lock, flags))
return 0; return;
if (crng_init != 0) { if (crng_init != 0) {
spin_unlock_irqrestore(&base_crng.lock, flags); spin_unlock_irqrestore(&base_crng.lock, flags);
return 0; return;
} }
if (len > max)
max = len;
for (i = 0; i < max; i++) { blake2s_update(&hash, base_crng.key, sizeof(base_crng.key));
tmp = lfsr; blake2s_update(&hash, cp, len);
lfsr >>= 1; blake2s_final(&hash, base_crng.key);
if (tmp & 1)
lfsr ^= 0xE1;
tmp = dest_buf[i % sizeof(base_crng.key)];
dest_buf[i % sizeof(base_crng.key)] ^= src_buf[i % len] ^ lfsr;
lfsr += (tmp << 3) | (tmp >> 5);
}
spin_unlock_irqrestore(&base_crng.lock, flags); spin_unlock_irqrestore(&base_crng.lock, flags);
return 1;
} }
static void crng_reseed(void) static void crng_reseed(void)