2023-03-28 03:41:50

by Herbert Xu

Subject: [PATCH] crypto: drbg - Only fail when jent is unavailable in FIPS mode

When jent initialisation fails for any reason other than ENOENT,
the entire drbg fails to initialise, even when we're not in FIPS
mode. This is wrong because we can still use the kernel RNG when
we're not in FIPS mode.

Change it so that it only fails when we are in FIPS mode.

Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness")
Signed-off-by: Herbert Xu <[email protected]>

diff --git a/crypto/drbg.c b/crypto/drbg.c
index 982d4ca4526d..ff4ebbc68efa 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -1546,7 +1546,7 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
const int err = PTR_ERR(drbg->jent);

drbg->jent = NULL;
- if (fips_enabled || err != -ENOENT)
+ if (fips_enabled)
return err;
pr_info("DRBG: Continuing without Jitter RNG\n");
}
--
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

2023-03-28 08:09:50

by Stephan Müller

Subject: Re: [PATCH] crypto: drbg - Only fail when jent is unavailable in FIPS mode

Am Dienstag, 28. M?rz 2023, 05:35:23 CEST schrieb Herbert Xu:

Hi Herbert,

> When jent initialisation fails for any reason other than ENOENT,
> the entire drbg fails to initialise, even when we're not in FIPS
> mode. This is wrong because we can still use the kernel RNG when
> we're not in FIPS mode.
>
> Change it so that it only fails when we are in FIPS mode.

Reviewed-by: Stephan Mueller <[email protected]>

Ciao
Stephan