tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

crypto: rng - Make crypto_stdrng_get_bytes() use normal RNG in non-FIPS mode

"stdrng" is needed only in "FIPS mode". Therefore, make
crypto_stdrng_get_bytes() delegate to either the normal Linux RNG or to
"stdrng", depending on the current mode.

This will eliminate the need to built the SP800-90A DRBG and its
dependencies into CRYPTO_FIPS=n kernels.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

authored by

Eric Biggers and committed by
Herbert Xu 65b3c2f6 bdd2cc93

+15 -4
+2 -2
crypto/rng.c
··· 142 142 mutex_unlock(&crypto_default_rng_lock); 143 143 } 144 144 145 - int crypto_stdrng_get_bytes(void *buf, unsigned int len) 145 + int __crypto_stdrng_get_bytes(void *buf, unsigned int len) 146 146 { 147 147 int err; 148 148 ··· 154 154 crypto_put_default_rng(); 155 155 return err; 156 156 } 157 - EXPORT_SYMBOL_GPL(crypto_stdrng_get_bytes); 157 + EXPORT_SYMBOL_GPL(__crypto_stdrng_get_bytes); 158 158 159 159 #if defined(CONFIG_CRYPTO_RNG) || defined(CONFIG_CRYPTO_RNG_MODULE) 160 160 int crypto_del_default_rng(void)
+13 -2
include/crypto/rng.h
··· 12 12 #include <linux/atomic.h> 13 13 #include <linux/container_of.h> 14 14 #include <linux/crypto.h> 15 + #include <linux/fips.h> 16 + #include <linux/random.h> 15 17 16 18 struct crypto_rng; 17 19 ··· 59 57 struct crypto_tfm base; 60 58 }; 61 59 60 + int __crypto_stdrng_get_bytes(void *buf, unsigned int len); 61 + 62 62 /** 63 63 * crypto_stdrng_get_bytes() - get cryptographically secure random bytes 64 64 * @buf: output buffer holding the random numbers 65 65 * @len: length of the output buffer 66 66 * 67 67 * This function fills the caller-allocated buffer with random numbers using the 68 - * highest-priority "stdrng" algorithm in the crypto_rng subsystem. 68 + * normal Linux RNG if fips_enabled=0, or the highest-priority "stdrng" 69 + * algorithm in the crypto_rng subsystem if fips_enabled=1. 69 70 * 70 71 * Context: May sleep 71 72 * Return: 0 function was successful; < 0 if an error occurred 72 73 */ 73 - int crypto_stdrng_get_bytes(void *buf, unsigned int len); 74 + static inline int crypto_stdrng_get_bytes(void *buf, unsigned int len) 75 + { 76 + might_sleep(); 77 + if (fips_enabled) 78 + return __crypto_stdrng_get_bytes(buf, len); 79 + return get_random_bytes_wait(buf, len); 80 + } 74 81 75 82 /** 76 83 * DOC: Random number generator API