]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
crypto: loongson - Remove broken and unused loongson-rng
authorEric Biggers <ebiggers@kernel.org>
Fri, 29 May 2026 23:32:08 +0000 (16:32 -0700)
committerHerbert Xu <herbert@gondor.apana.org.au>
Thu, 11 Jun 2026 05:53:59 +0000 (13:53 +0800)
The loongson-rng rng_alg has several vulnerabilities, including not
providing forward security, and a use-after-free bug due to the use of
wait_for_completion_interruptible().

Meanwhile, the rng_alg framework doesn't really have any purpose in the
first place other than to access the software algorithms crypto/drbg.c
and crypto/jitterentropy.c.  Hardware-specific rng_algs have no
in-kernel user, and unlike hwrng there's no feed into the actual Linux
RNG.  As such, there's really no point to this code.  There are of
course other rng_alg drivers that are similarly unused, but they're
similarly in the process of being phased out, e.g.
https://lore.kernel.org/r/20260529193648.18172-1-ebiggers@kernel.org and
https://lore.kernel.org/r/20260529220430.34135-1-ebiggers@kernel.org

Given that, there's no point in fixing forward these vulnerabilities,
and it makes much more sense to simply roll back the addition of this
driver.  If this platform provides TRNG (not PRNG) functionality, it
could make sense to add a hwrng driver, but it would be quite different.

Link: https://lore.kernel.org/linux-crypto/20260525145939.GC2018@quark/
Fixes: 766b2d724c8d ("crypto: loongson - add Loongson RNG driver support")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
MAINTAINERS
arch/loongarch/configs/loongson32_defconfig
arch/loongarch/configs/loongson64_defconfig
drivers/crypto/Kconfig
drivers/crypto/Makefile
drivers/crypto/loongson/Kconfig [deleted file]
drivers/crypto/loongson/Makefile [deleted file]
drivers/crypto/loongson/loongson-rng.c [deleted file]

index 882214b0e7db53bb8cc8e75b5d2269ee0591ea20..6c805560c77c6712a0209008f2203477d82ced9d 100644 (file)
@@ -15070,7 +15070,6 @@ M:      Qunqin Zhao <zhaoqunqin@loongson.cn>
 L:     linux-crypto@vger.kernel.org
 S:     Maintained
 F:     drivers/char/tpm/tpm_loongson.c
-F:     drivers/crypto/loongson/
 F:     drivers/mfd/loongson-se.c
 F:     include/linux/mfd/loongson-se.h
 
index d5ef396dffe300027404b9750f03da907d5b1f92..82897236863fbc570af4eb7d6a9278eb1b3b6fb8 100644 (file)
@@ -1091,7 +1091,6 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_CRYPTO_DEV_VIRTIO=m
-CONFIG_CRYPTO_DEV_LOONGSON_RNG=m
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_PRINTK_TIME=y
index cba4cdff5acd8c9e0b69134dd05e973ab060f947..a94e88bd7ec5c5fe489095ebea97dede6e288cf4 100644 (file)
@@ -1124,7 +1124,6 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_CRYPTO_DEV_VIRTIO=m
-CONFIG_CRYPTO_DEV_LOONGSON_RNG=m
 CONFIG_DMA_CMA=y
 CONFIG_DMA_NUMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
index 5dab813a9f74fa3c228298a9b231e79e132138cf..223cb3c3226137f9ebcaacbbcbc2620f4e83ba91 100644 (file)
@@ -845,7 +845,6 @@ config CRYPTO_DEV_CCREE
          If unsure say Y.
 
 source "drivers/crypto/hisilicon/Kconfig"
-source "drivers/crypto/loongson/Kconfig"
 
 source "drivers/crypto/amlogic/Kconfig"
 
index 283bbc650b5b22a3f2a5a1ec81ca42ae3d37a80f..ad773158ae5601f0d4f04c8b8e2e56e2c9a6d207 100644 (file)
@@ -43,7 +43,6 @@ obj-y += inside-secure/
 obj-$(CONFIG_CRYPTO_DEV_ARTPEC6) += axis/
 obj-y += xilinx/
 obj-y += hisilicon/
-obj-y += loongson/
 obj-$(CONFIG_CRYPTO_DEV_AMLOGIC_GXL) += amlogic/
 obj-y += intel/
 obj-y += starfive/
diff --git a/drivers/crypto/loongson/Kconfig b/drivers/crypto/loongson/Kconfig
deleted file mode 100644 (file)
index f4e1544..0000000
+++ /dev/null
@@ -1,6 +0,0 @@
-config CRYPTO_DEV_LOONGSON_RNG
-       tristate "Support for Loongson RNG Driver"
-       depends on MFD_LOONGSON_SE
-       select CRYPTO_RNG
-       help
-         Support for Loongson RNG Driver.
diff --git a/drivers/crypto/loongson/Makefile b/drivers/crypto/loongson/Makefile
deleted file mode 100644 (file)
index 1ce5ec3..0000000
+++ /dev/null
@@ -1 +0,0 @@
-obj-$(CONFIG_CRYPTO_DEV_LOONGSON_RNG)  += loongson-rng.o
diff --git a/drivers/crypto/loongson/loongson-rng.c b/drivers/crypto/loongson/loongson-rng.c
deleted file mode 100644 (file)
index 3a49402..0000000
+++ /dev/null
@@ -1,209 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/* Copyright (c) 2019 HiSilicon Limited. */
-/* Copyright (c) 2025 Loongson Technology Corporation Limited. */
-
-#include <linux/crypto.h>
-#include <linux/err.h>
-#include <linux/hw_random.h>
-#include <linux/io.h>
-#include <linux/iopoll.h>
-#include <linux/kernel.h>
-#include <linux/list.h>
-#include <linux/mfd/loongson-se.h>
-#include <linux/module.h>
-#include <linux/mutex.h>
-#include <linux/platform_device.h>
-#include <linux/random.h>
-#include <crypto/internal/rng.h>
-
-#define SE_SEED_SIZE 32
-
-struct loongson_rng_list {
-       struct mutex lock;
-       struct list_head list;
-       int registered;
-};
-
-struct loongson_rng {
-       u32 used;
-       struct loongson_se_engine *engine;
-       struct list_head list;
-       struct mutex lock;
-};
-
-struct loongson_rng_ctx {
-       struct loongson_rng *rng;
-};
-
-struct loongson_rng_cmd {
-       u32 cmd_id;
-       union {
-               u32 len;
-               u32 ret;
-       } u;
-       u32 seed_off;
-       u32 out_off;
-       u32 pad[4];
-};
-
-static struct loongson_rng_list rng_devices = {
-       .lock = __MUTEX_INITIALIZER(rng_devices.lock),
-       .list = LIST_HEAD_INIT(rng_devices.list),
-};
-
-static int loongson_rng_generate(struct crypto_rng *tfm, const u8 *src,
-                         unsigned int slen, u8 *dstn, unsigned int dlen)
-{
-       struct loongson_rng_ctx *ctx = crypto_rng_ctx(tfm);
-       struct loongson_rng *rng = ctx->rng;
-       struct loongson_rng_cmd *cmd = rng->engine->command;
-       int err, len;
-
-       mutex_lock(&rng->lock);
-       cmd->seed_off = 0;
-       do {
-               len = min(dlen, rng->engine->buffer_size);
-               cmd = rng->engine->command;
-               cmd->u.len = len;
-               err = loongson_se_send_engine_cmd(rng->engine);
-               if (err)
-                       break;
-
-               cmd = rng->engine->command_ret;
-               if (cmd->u.ret) {
-                       err = -EIO;
-                       break;
-               }
-
-               memcpy(dstn, rng->engine->data_buffer, len);
-               dlen -= len;
-               dstn += len;
-       } while (dlen > 0);
-       mutex_unlock(&rng->lock);
-
-       return err;
-}
-
-static int loongson_rng_init(struct crypto_tfm *tfm)
-{
-       struct loongson_rng_ctx *ctx = crypto_tfm_ctx(tfm);
-       struct loongson_rng *rng;
-       u32 min_used = U32_MAX;
-
-       mutex_lock(&rng_devices.lock);
-       list_for_each_entry(rng, &rng_devices.list, list) {
-               if (rng->used < min_used) {
-                       ctx->rng = rng;
-                       min_used = rng->used;
-               }
-       }
-       ctx->rng->used++;
-       mutex_unlock(&rng_devices.lock);
-
-       return 0;
-}
-
-static void loongson_rng_exit(struct crypto_tfm *tfm)
-{
-       struct loongson_rng_ctx *ctx = crypto_tfm_ctx(tfm);
-
-       mutex_lock(&rng_devices.lock);
-       ctx->rng->used--;
-       mutex_unlock(&rng_devices.lock);
-}
-
-static int loongson_rng_seed(struct crypto_rng *tfm, const u8 *seed,
-                            unsigned int slen)
-{
-       struct loongson_rng_ctx *ctx = crypto_rng_ctx(tfm);
-       struct loongson_rng *rng = ctx->rng;
-       struct loongson_rng_cmd *cmd;
-       int err;
-
-       if (slen < SE_SEED_SIZE)
-               return -EINVAL;
-
-       slen = min(slen, rng->engine->buffer_size);
-
-       mutex_lock(&rng->lock);
-       cmd = rng->engine->command;
-       cmd->u.len = slen;
-       cmd->seed_off = rng->engine->buffer_off;
-       memcpy(rng->engine->data_buffer, seed, slen);
-       err = loongson_se_send_engine_cmd(rng->engine);
-       if (err)
-               goto out;
-
-       cmd = rng->engine->command_ret;
-       if (cmd->u.ret)
-               err = -EIO;
-out:
-       mutex_unlock(&rng->lock);
-
-       return err;
-}
-
-static struct rng_alg loongson_rng_alg = {
-       .generate = loongson_rng_generate,
-       .seed = loongson_rng_seed,
-       .seedsize = SE_SEED_SIZE,
-       .base = {
-               .cra_name = "stdrng",
-               .cra_driver_name = "loongson_stdrng",
-               .cra_priority = 300,
-               .cra_ctxsize = sizeof(struct loongson_rng_ctx),
-               .cra_module = THIS_MODULE,
-               .cra_init = loongson_rng_init,
-               .cra_exit = loongson_rng_exit,
-       },
-};
-
-static int loongson_rng_probe(struct platform_device *pdev)
-{
-       struct loongson_rng_cmd *cmd;
-       struct loongson_rng *rng;
-       int ret = 0;
-
-       rng = devm_kzalloc(&pdev->dev, sizeof(*rng), GFP_KERNEL);
-       if (!rng)
-               return -ENOMEM;
-
-       rng->engine = loongson_se_init_engine(pdev->dev.parent, SE_ENGINE_RNG);
-       if (!rng->engine)
-               return -ENODEV;
-       cmd = rng->engine->command;
-       cmd->cmd_id = SE_CMD_RNG;
-       cmd->out_off = rng->engine->buffer_off;
-       mutex_init(&rng->lock);
-
-       mutex_lock(&rng_devices.lock);
-
-       if (!rng_devices.registered) {
-               ret = crypto_register_rng(&loongson_rng_alg);
-               if (ret) {
-                       dev_err(&pdev->dev, "failed to register crypto(%d)\n", ret);
-                       goto out;
-               }
-               rng_devices.registered = 1;
-       }
-
-       list_add_tail(&rng->list, &rng_devices.list);
-out:
-       mutex_unlock(&rng_devices.lock);
-
-       return ret;
-}
-
-static struct platform_driver loongson_rng_driver = {
-       .probe          = loongson_rng_probe,
-       .driver         = {
-               .name   = "loongson-rng",
-       },
-};
-module_platform_driver(loongson_rng_driver);
-
-MODULE_ALIAS("platform:loongson-rng");
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Yinggang Gu <guyinggang@loongson.cn>");
-MODULE_AUTHOR("Qunqin Zhao <zhaoqunqin@loongson.cn>");
-MODULE_DESCRIPTION("Loongson Random Number Generator driver");