random: early initialization of ChaCha constants

commit 96562f286884e2db89c74215b199a1084b5fb7f7 upstream.

Previously, the ChaCha constants for the primary pool were only
initialized in crng_initialize_primary(), called by rand_initialize().
However, some randomness is actually extracted from the primary pool
beforehand, e.g. by kmem_cache_create(). Therefore, statically
initialize the ChaCha constants for the primary pool.

Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: <linux-crypto@vger.kernel.org>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/char/random.c b/drivers/char/random.c
index f947c39572f29e933c995dbb73bb691e7252a659..05abbab5babdb7f47396fdbad3627edeaed2bace 100644 (file)
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -458,6 +458,10 @@ struct crng_state {
 
 static struct crng_state primary_crng = {
        .lock = __SPIN_LOCK_UNLOCKED(primary_crng.lock),
+       .state[0] = CHACHA_CONSTANT_EXPA,
+       .state[1] = CHACHA_CONSTANT_ND_3,
+       .state[2] = CHACHA_CONSTANT_2_BY,
+       .state[3] = CHACHA_CONSTANT_TE_K,
 };
 
 /*
@@ -824,7 +828,6 @@ static void crng_initialize_secondary(struct crng_state *crng)
 
 static void __init crng_initialize_primary(struct crng_state *crng)
 {
-       chacha_init_consts(crng->state);
        _extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0);
        if (crng_init_try_arch_early(crng) && trust_cpu && crng_init < 2) {
                invalidate_batched_entropy();

diff --git a/include/crypto/chacha20.h b/include/crypto/chacha20.h
index 0d8cc82df48b6a90a00ecf3c5ec89eb270709497..04bdf4bf197d59f18d7e249c65a36f00c55b367f 100644 (file)
--- a/include/crypto/chacha20.h
+++ b/include/crypto/chacha20.h
@@ -25,12 +25,19 @@ int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
                           unsigned int keysize);
 int crypto_chacha20_crypt(struct skcipher_request *req);
 
+enum chacha_constants { /* expand 32-byte k */
+       CHACHA_CONSTANT_EXPA = 0x61707865U,
+       CHACHA_CONSTANT_ND_3 = 0x3320646eU,
+       CHACHA_CONSTANT_2_BY = 0x79622d32U,
+       CHACHA_CONSTANT_TE_K = 0x6b206574U
+};
+
 static inline void chacha_init_consts(u32 *state)
 {
-       state[0]  = 0x61707865; /* "expa" */
-       state[1]  = 0x3320646e; /* "nd 3" */
-       state[2]  = 0x79622d32; /* "2-by" */
-       state[3]  = 0x6b206574; /* "te k" */
+       state[0]  = CHACHA_CONSTANT_EXPA;
+       state[1]  = CHACHA_CONSTANT_ND_3;
+       state[2]  = CHACHA_CONSTANT_2_BY;
+       state[3]  = CHACHA_CONSTANT_TE_K;
 }
 
 #endif