Received: by 10.192.165.156 with SMTP id m28csp142348imm; Thu, 12 Apr 2018 18:33:23 -0700 (PDT) X-Google-Smtp-Source: AIpwx48XQeagA5ES5EnE1onoycxlLtIIYDlSu0AdEHlRqHiRak66bvHNd0JfT8PBcSr9F1TEdf37 X-Received: by 2002:a17:902:8211:: with SMTP id x17-v6mr3279573pln.130.1523583203824; Thu, 12 Apr 2018 18:33:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523583203; cv=none; d=google.com; s=arc-20160816; b=Qvvcutx9vWoufXSmsSt76KdPVvNY1wRYqzg3TGKImc/pElbVnKYkAyh4eG858OdAQy YyV3cIOi4B7iEb0ZP6t89wQ12S5nkSIpnHxge+LL/aaEkgCTxLwF/GBcScqktwRjPQJc Yio6Bxke+Yr/0T5IOz1ohLF8Kjjb+bn+BCdbi3iyZFD32sOZ9J8V+98tijuk426lyXki mvQrey8OLGry2s+7vr1ICwGaXa38K0aJCjZGoIcyP+gY5SNWsvMYBgzUxqMZeMFfCWpB UK7c6JKb58H5wXTEPaBztqtzzpiVmO2ZT/DdMPZtB+TPuzspgaL/q7MkODVce4HSzlVq AktA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=TS2j2NDy3hHPYkoq9iFpq1Tv+snNHBrjr+oycdxK0Mo=; b=d0x3X6lbCgiamdkFDP3HFMSytk7u1kikKTD9DB5QlMUWbdHgkpcvhMUBCb4rfUpAVz yaWBx6TTsxj9GhN5MjA5j8p2Iv69BNarjslDf3nVNRyxjDn9OsQCIrPNvybOexTPGwuP R723tpDwj8qmyehTad6hIXzsx+503eDY+5fM3IA9HNyawybEOTam/iztaeYxd0oClfdY UEtiJ6i2fmYxqlfNfyi4BY9Ra+8n1VIHiAsZLbeOMzJNrCGdo0KSSFtjOucwdf7IC31p Rq/FG5ovApWNH+I/zpTVIM2JQnS/lW5gqHbFkZfGw74bvVUMnjwzq91mxs1NYYx4zHWE OMAA== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@thunk.org header.s=ef5046eb header.b=oSTGaznJ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 67si3549154pfr.239.2018.04.12.18.33.09; Thu, 12 Apr 2018 18:33:23 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=fail header.i=@thunk.org header.s=ef5046eb header.b=oSTGaznJ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753612AbeDMBbh (ORCPT + 99 others); Thu, 12 Apr 2018 21:31:37 -0400 Received: from imap.thunk.org ([74.207.234.97]:37198 "EHLO imap.thunk.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752486AbeDMBa6 (ORCPT ); Thu, 12 Apr 2018 21:30:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=thunk.org; s=ef5046eb; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From: Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=TS2j2NDy3hHPYkoq9iFpq1Tv+snNHBrjr+oycdxK0Mo=; b=oSTGaznJb1GLjE1d/4ezg81aXn 1khruvfL5fmpvJ9gHFImMsZI9slYlI57umWCghPNHaCp3Wa81RXMD3bCQ765bJNKkzmXH3VYSgU6o kp1WobQTj5wAsECVXaRBrFGFk26SmSmEmn02m7NjIZojB4tOCwrUfmkcDV1EFrSm/nGE=; Received: from root (helo=callcc.thunk.org) by imap.thunk.org with local-esmtp (Exim 4.89) (envelope-from ) id 1f6nYG-0002d5-M3; Fri, 13 Apr 2018 01:30:56 +0000 Received: by callcc.thunk.org (Postfix, from userid 15806) id 58E407A2E21; Thu, 12 Apr 2018 21:30:55 -0400 (EDT) From: Theodore Ts'o To: linux-crypto@vger.kernel.org Cc: Linux Kernel Developers List , Theodore Ts'o , stable@kernel.org Subject: [PATCH 2/5] random: use a different mixing algorithm for add_device_randomness() Date: Thu, 12 Apr 2018 21:30:43 -0400 Message-Id: <20180413013046.404-2-tytso@mit.edu> X-Mailer: git-send-email 2.16.1.72.g5be1f00a9a In-Reply-To: <20180413013046.404-1-tytso@mit.edu> References: <20180413013046.404-1-tytso@mit.edu> X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: tytso@thunk.org X-SA-Exim-Scanned: No (on imap.thunk.org); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org add_device_randomness() use of crng_fast_load() was highly problematic. Some callers of add_device_randomness() can pass in a large amount of static information. This would immediately promote the crng_init state from 0 to 1, without really doing much to initialize the primary_crng's internal state with something even vaguely unpredictable. Since we don't have the speed constraints of add_interrupt_randomness(), we can do a better job mixing in the what unpredictability a device driver or architecture maintainer might see fit to give us, and do it in a way which does not bump the crng_init_cnt variable. Also, since add_device_randomness() doesn't bump any entropy accounting in crng_init state 0, mix the device randomness into the input_pool entropy pool as well. Reported-by: Jann Horn Fixes: ee7998c50c26 ("random: do not ignore early device randomness") Cc: stable@kernel.org # 4.13+ Signed-off-by: Theodore Ts'o --- drivers/char/random.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 51 insertions(+), 4 deletions(-) diff --git a/drivers/char/random.c b/drivers/char/random.c index c8ec1e70abde..2154a5fe4c81 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -787,6 +787,10 @@ static void crng_initialize(struct crng_state *crng) crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1; } +/* + * crng_fast_load() can be called by code in the interrupt service + * path. So we can't afford to dilly-dally. + */ static int crng_fast_load(const char *cp, size_t len) { unsigned long flags; @@ -813,6 +817,51 @@ static int crng_fast_load(const char *cp, size_t len) return 1; } +/* + * crng_slow_load() is called by add_device_randomness, which has two + * attributes. (1) We can't trust the buffer passed to it is + * guaranteed to be unpredictable (so it might not have any entropy at + * all), and (2) it doesn't have the performance constraints of + * crng_fast_load(). + * + * So we do something more comprehensive which is guaranteed to touch + * all of the primary_crng's state, and which uses a LFSR with a + * period of 255 as part of the mixing algorithm. Finally, we do + * *not* advance crng_init_cnt since buffer we may get may be something + * like a fixed DMI table (for example), which might very well be + * unique to the machine, but is otherwise unvarying. + */ +static int crng_slow_load(const char *cp, size_t len) +{ + unsigned long flags; + static unsigned char lfsr = 1; + unsigned char tmp; + unsigned i, max = CHACHA20_KEY_SIZE; + const char * src_buf = cp; + char * dest_buf = (char *) &primary_crng.state[4]; + + if (!spin_trylock_irqsave(&primary_crng.lock, flags)) + return 0; + if (crng_init != 0) { + spin_unlock_irqrestore(&primary_crng.lock, flags); + return 0; + } + if (len > max) + max = len; + + for (i = 0; i < max ; i++) { + tmp = lfsr; + lfsr >>= 1; + if (tmp & 1) + lfsr ^= 0xE1; + tmp = dest_buf[i % CHACHA20_KEY_SIZE]; + dest_buf[i % CHACHA20_KEY_SIZE] ^= src_buf[i % len] ^ lfsr; + lfsr += (tmp << 3) | (tmp >> 5); + } + spin_unlock_irqrestore(&primary_crng.lock, flags); + return 1; +} + static void crng_reseed(struct crng_state *crng, struct entropy_store *r) { unsigned long flags; @@ -981,10 +1030,8 @@ void add_device_randomness(const void *buf, unsigned int size) unsigned long time = random_get_entropy() ^ jiffies; unsigned long flags; - if (!crng_ready()) { - crng_fast_load(buf, size); - return; - } + if (!crng_ready()) + crng_slow_load(buf, size); trace_add_device_randomness(size, _RET_IP_); spin_lock_irqsave(&input_pool.lock, flags); -- 2.16.1.72.g5be1f00a9a